Medical & Health Research Act
Act on Medical and Health Research (Health Research Act)
(Source: https://lovdata.no/dokument/NL/lov/1999-07-02-64)
Norwegian to English Translation via University of Oslo (UiO)
Act on Medical and Health Research (Health Research Act)
(Source: https://lovdata.no/dokument/NL/lov/1999-07-02-64)
Norwegian to English Translation via University of Oslo (UiO)
ACT 2008-06-20 no. 44: Act on medical and health research (the Health Research Act)
CONTENTS
Act on medical and health research (the Health Research Act)
Chapter 1. Purpose and scope of the Act
§ 1. Purpose of the Act
§ 2. Substantive scope of the Act
§ 3. Territorial scope of the Act
§ 4. Definitions
Chapter 2. Requirements concerning organisation and execution of medical and health research
§ 5. Responsible conduct
§ 6. Main requirements on organisation of research
§ 7. Duty of confidentiality
§ 8. Commercial exploitation
Chapter 3. Application and duty to notify the Regional Committee for Medical and Health Research Ethics
§ 9. Requirements concerning prior approval
§ 10. Application for prior approval
§ 11. Application to make substantial changes to a research project
§ 12. Final report and reports
Chapter 4. Consent
§ 13. Main rule on consent
§ 14. Broad consent
§ 15. New or changed use of collected human biological material or personal health data
§ 16. Withdrawal of consent
§ 17. Competence to give consent
§ 18. Conditions for research including people who lack competence to give their consent
§ 19. Consent to research in clinical emergencies
§ 20. Anonymous human biological material and personal health data
§ 21. Research on human biological material from deceased persons
Chapter 5. Research involving people
§ 22. General provisions concerning research on people
§ 23. Duty to report adverse medical incidents §
24. Duty to provide information to participants in connection with injury etc.
Chapter 6. Research biobanks and research involving human biological material
§ 25. Establishment of research biobanks
§ 26. Entity responsible for a biobank
§ 27. Requirements concerning storage and processing
§ 28. Right to use biological material collected by the health service for research
§ 29. Transfer of human biological material to and from foreign countries
§ 30. Discontinuation, closure or takeover of research biobanks
§ 31. Other parties’ access to material in a research biobank
Chapter 7. Research using personal health data
§ 32. Main rule on processing personal health data
§ 33. Requirements concerning authority to process data and prior approval
§ 34. Processing of personal health data
§ 35. Access to use personal health data collected by the health service for research
§ 36. Correction of personal health data, etc.
§ 37. Data transfer to and from nations outside the EEA Area
§ 38. Prohibition against storing unnecessary personal health data
Chapter 8. Transparency and right of access to the research
39. Transparency
§40. Right of access for research participants
§ 41. Public right of access
§ 42. Exceptions to the right of access
§ 43. Time limit on the right of access
§ 44. Public register of research projects and research biobanks
§ 45. Deferred publication Chapter
Chapter 9. Supervision
§ 46. The authority of the Norwegian Board of Health Supervision
§ 47. The authority of the Norwegian Data Inspectorate
§ 48. Duty to inform the regulatory authorities
§ 49. The regulatory authorities’ duty of confidentiality
Chapter 10. Compensation, orders, penalties, etc.
§ 50. Compensation
§ 51. The Norwegian Board of Health Supervision’s right to issue orders concerning correction, discontinuation, etc.
§ 52. The Norwegian Data Inspectorate’s right to issue orders concerning correction, discontinuation, etc.
§ 53. Coercive fines
§ 54. Penalties Chapter 11. Final provisions
§ 55. Entry into force and transitional rules
§ 56. Amendments in other Acts of law
Act on medical and health research (the Health Research Act)
Chapter 1. Purpose and scope of the Act
§ 1. Purpose
The purpose of the Act is to promote good and ethically sound medical and health research.
§ 2. Substantive scope of the Act
The Act applies to all medical and health research on human beings, human biological material or personal health data. Such research also includes pilot studies and experimental treatments.
The Act does not apply to establishment of health registers.
Unless otherwise provided by this Act, the Personal Data Act and appurtenant regulations apply as supplementary provisions. Clinical testing of medicinal products on human beings is covered by Section 3 of the Medicines Act and appurtenant regulations. Clinical testing of medical equipment is covered by the Act on Medical Equipment and appurtenant regulations. In this context, the provisions of this Act apply as a supplement, where relevant.
The Ministry may by regulations lay down provisions concerning the application of the Act in special areas within medical and health research.
§ 3. Territorial scope of the Act
The Act applies to research conducted on Norwegian territory or if the research is being done under the direction of a person or body responsible for the research established in Norway.
The Act does not apply to use of personal health data if the person or body responsible for the research is established in another EEA State. Nor does the Act apply to use of personal health data if the person or body responsible for the research is established in a state outside the EEA Area and the institution does not use tools in Norway for purposes other than pure transfer of personal health data.
The King may by regulations decide the extent to which the Act will be applied in Svalbard and Jan Mayen.
§ 4. Definitions
For the purposes of this Act, the following definitions shall apply:
a) medical and health research: activity conducted using scientific methods to generate new knowledge about health and disease,
b) human biological material: organs, parts of organs, cells and tissues and components of this kind of material from living and deceased human beings,
c) research biobank: a collection of human biological material that is used in a research project or that is going to be used for research,
d) personal health data: confidential information pursuant to Section 21 of the Health Personnel Act and other information and assessments concerning health issues or that are significant for health issues that can be linked to an individual person,
e) person or body responsible for the research: institution or some other legal or physical person who has the overall responsibility for the research project and who has the necessary capabilities to be able to fulfil the duties ascribed to the person or body responsible for the research pursuant to this Act,
f) project manager: a physical person who is responsible for the day-to-day operation of the research project and who has the necessary research qualifications and experience to be able to fulfil the duties ascribed to the project manager pursuant to this Act.
Chapter 2. Requirements concerning organisation and execution of medical and health research
§ 5. Responsible conduct
Medical and health research must be organised and carried out in a responsible manner.
Research must be based on respect for the research participants’ human rights and dignity. The participants’ welfare and integrity shall have priority over scientific and social interests.
Medical and health research must take into account ethical, medical, health, scientific and privacy factors.
§ 6. Main requirements on organisation of research
Medical and health research must be organised as a project under the direction of a person or body responsible for the research and managed by a project manager and must be described in a research protocol.
The sources of funding must be indicated in the protocol. Internal control must be carried out in a manner that is adapted to the size, nature, activities and risk factors of the research.
The Ministry may lay down regulations with further requirements concerning the organisation of medical and health research, requirements concerning the research protocol and concerning internal control, and may also lay down provisions concerning the duties of the project manager and the person or body responsible for the research.
§ 7. Duty of confidentiality
Any party that has access to personal health data and other personal data that are used in a research project must prevent other people from gaining access to or knowledge of the data.
The duty of confidentiality does not impede the information being communicated to the person it concerns directly or being surrendered when the recipient has legal grounds for having the information disclosed, cf. Section 13.
§ 8. Commercial exploitation
Commercial exploitation of research participants, human biological material and personal health data in general is prohibited.
Chapter 3. Application and duty to notify the regional committee for medical and health research ethics
§ 9. Requirements concerning prior approval
The research project must be approved in advance by the regional committee for medical and health research ethics, cf. Section 4 of Act of 30 June 2006 no. 56 on ethics and integrity in research.
§ 10. Application for prior approval
An application for prior approval of a research project must be submitted with the research protocol to the regional committee for medical and health research ethics.
The regional committee for medical and health research ethics undertakes a standard evaluation of the research ethics of the project and judges whether the project satisfies the requirements laid down in this Act or pursuant to this Act. The regional committee for medical and health research ethics may specify conditions for approval.
Decisions regarding prior approval of the research project may be appealed to the National Committee for Medical and Health Research Ethics, cf. Section 4 of Act of 30 June 2006 no. 56 on ethics and integrity in research.
The Ministry may issue regulations containing requirements concerning the application, time limits for the regional committee for medical and health research ethics’ consideration of applications and more detailed conditions for prior approval.
§ 11. Application to make substantial changes to a research project
If the project manager wants to make substantial changes to the objective, method, schedule or organisation of the research project, an application must be submitted to the regional committee for medical and health research ethics that has granted prior approval. The application must describe the proposed changes and the reasons for them.
The regional committee for medical and health research ethics decides whether the application is granted or denied. If the changes to the project are so great that it needs to be regarded as a new project, the regional committee for medical and health research ethics may decide that prior approval must be applied for in accordance with Section 9 (cf. Section 10) again.
The Ministry may issue regulations containing requirements concerning processing of applications and time limits for the processing of applications.
§ 12. Final report and reports
The project manager must submit a final report to the regional committee for medical and health research ethics when the research project is finished. The final report must present the findings objectively and methodically, ensuring that both positive and negative findings are presented.
The regional committee for medical and health research ethics may stipulate requirements regarding the content of the final report.
The regional committee for medical and health research ethics may order the project manager to submit annual or extraordinary reports, if the Committee deems it necessary.
Chapter 4. Consent
§ 13. Main rule on consent
Consent must be obtained from participants in medical and health research, unless otherwise laid down in law.
Consent must be informed, voluntary, express and documented. Consent must be based on specific information about a concrete research project, unless there is a case for granting broad consent, cf. Section 14.
If the research participant can be regarded as being in a relationship of dependency with the person requesting consent, meaning that the research participant might feel pressured to give their consent, informed consent must be obtained by another person whom the research participant does not have this kind of relationship with.
The Ministry may lay down regulations concerning consent.
§ 14. Broad consent
Pursuant to Section 13, research participants may consent to human biological material and personal health data being used for specific, broadly defined research purposes.
The regional committee for medical and health research ethics may specify conditions for use of broad consent and may order the project manager to obtain new consent if the committee deems it necessary.
Participants who have given broad consent are entitled to receive information about the project at regular intervals.
§ 15. New or changed use of collected human biological material or personal health data
In the event of substantial changes to the research project, new consent must be obtained in accordance with Section 13 if the changes are deemed to have consequences for the participant’s consent.
If it is difficult to obtain new consent, the regional committee for medical and health research ethics may approve new or changed use of previously collected human biological material or personal health data without new consent being obtained. This may only be applied if the research in question is of significant interest to society and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use.
§ 16. Withdrawal of consent
Consent to take part in a research project may be withdrawn at any time.
If a participant withdraws his/her consent, research on their biological material or personal health data must stop. A person who has withdrawn their consent may demand that their biological material is destroyed and that the personal health data are deleted or surrendered within 30 days.
The right to demand destruction, deletion or surrender of biological material or health data pursuant to the second paragraph does not apply if the material or data have been anonymised, if the material has been processed and is now part of another biological product, or if the data have already been included in completed analyses.
If particularly strong social or research considerations so warrant, the regional committee for medical and health research ethics may allow continued research on the material and defer destruction, deletion or surrender until the research project is concluded.
§ 17. Competence to give consent
The following people are entitled to consent to take part in medical and health research:
a) legally competent persons
b) minors aged 16 and over, unless otherwise follows from statutory provisions or the nature of the activity.
Competence to give consent pursuant to the first paragraph may cease to apply in the situations referred to in Section 4-3, second paragraph of the Patients’ Rights Act. Consent must be obtained from parents or other people with parental responsibility for research using minors aged 16–18 that entails bodily intervention or testing medicinal products.
The rules concerning consent stipulated in Section 4-4 of the Patients’ Rights Act apply correspondingly to consent to research including participants under the age of 16. If children between the ages of 12 and 16 do not want their parents, others with parental responsibility for them or the child welfare service to be informed about personal data relating to the child, for valid reasons, this wish must be respected.
For persons who lack competence to give consent pursuant to Section 4-3, second paragraph of the Patients’ Rights Act, the person’s next-of-kin as defined in Section 1-3, litra b of the Patients’ Rights Act shall have authority to grant consent.
Section 4-7 of the Patients’ Rights Act applies correspondingly to people who have been declared legally incapable of managing his or her own affairs pursuant to Act of 28 November 1898 relating to declaring a person incapable of managing his own affairs.
The Ministry may by regulations decide that for special types of research projects children between the ages of 12 and 16 may themselves consent to research on personal health data. The Ministry may lay down more detailed rules in regulations regarding the conditions for this kind of consent.
§ 18. Conditions for research including people who lack competence to give their consent
Research that includes minors and people who lack competence to give consent pursuant to Section 4-3 of the Patients’ Rights Act may only be done if the following conditions are met:
a) the potential risks or disadvantages for the person are insignificant,
b) the individual involved is not averse to it, and
c) there is reason to assume that the results of the research may be of use to the person concerned or other people with the same age-specific disorder, disease, injury or condition.
For minors, it is a requirement that similar research cannot be done on people who are not minors.
For people who lack competence to give their consent, it is a requirement that there is no reason to believe that the person concerned would have been averse to participating in the research project if they had had the capacity to give their consent, and that similar research cannot be done on people who have the capacity to give consent.
§ 19. Consent to research in clinical emergencies
In clinical emergencies where the patient is not capable of giving their consent and it is impossible to obtain consent from the person’s next-of-kin, research may only take place if the following conditions are satisfied:
a) the potential risks or disadvantages for the person are insignificant,
b) the individual involved is not averse to it and there is no reason for researchers or other personnel to believe that the person concerned would have been averse to participating in the research project if they had had the capacity to give their consent,
c) it is only possible to carry out the research in clinical emergency situations, and
d) the research is justified beyond any doubt on grounds of the prospect of results with major preventive, diagnostic or therapeutic value.
The research participant or their next-of-kin must be given information about the research at the first opportunity. Consent pursuant to Section 13 (cf. Section 17) is a prerequisite for further research and must be obtained without delay.
§ 20. Anonymous human biological material and personal health data
Consent is not required for research on anonymous human biological material and anonymous data. Consent pursuant to this chapter is required to collect material and data for subsequent anonymisation.
§ 21. Research on human biological material from deceased persons
Research on biological material taken from deceased persons is correspondingly subject to the provisions in Act of 9 February 1973 no. 6 relating to transplantation, hospital autopsies and the donation of bodies etc. and regulations issued pursuant to this Act.
Chapter 5. Research involving people
§ 22. General provisions concerning research on people
Research may only be done on people if there are no alternative methods that are approximately equally effective.
Before research is carried out on people, the risk and hazards for the participants must be thoroughly evaluated. They must be proportional to the expected advantages for the research participant personally or for other people.
Research must stop if it is found that the risk is greater than the possible advantages or if there are adequate grounds for positive, beneficial results.
Research may only be combined with treatment if the research is assumed to have health-promoting value for the research participant. The advantages, risks, disadvantages and effectiveness of a new method must be tested against the best methods for prevention, diagnosis and treatment that are currently available, unless especially compelling considerations dictate otherwise.
§ 23. Duty to report adverse medical incidents
The project manager must immediately notify the regulatory authorities in writing about serious adverse and unexpected medical incidents that are assumed to be linked to the research.
The project manager, other researchers and other personnel shall on their own initiative inform the regulatory authorities about factors that may jeopardise the safety of the research participants. The police must be notified immediately in the event of death from unnatural causes.
§ 24. Duty to provide information to participants in connection with injury etc.
The project manager must inform the research participants immediately if they have been injured or if complications have arisen as a result of the research project.
At the same time, the project manager must inform the research participant about his/her right to seek compensation from the Norwegian System of Compensation to Patients NPE1 and other insurance schemes.
Chapter 6. Research biobanks and research involving human biological material
§ 25. Establishment of research biobanks
A research biobank may only be established after approval by the regional committee for medical and health research ethics.
Research biobanks that are established in connection with collection, storage and use of human biological material as part of a research project must be described in the project’s research protocol.
Research biobanks that are established in connection with collection, storage and use of human biological material without affiliation to a concrete research project must be approved by the regional committee for medical and health research ethics. The same applies to research biobanks that are going to be used for storage and new use of human biological material once the original objective of a research project has been fulfilled.
The Ministry may by regulations issue provisions concerning what applications for establishment of research biobanks must include.
The Ministry may by regulations issue provisions concerning establishment and other processing of human biological material in biobanks linked to health registers pursuant to Sections 7 and 8 of the Personal Health Data Filing System Act.
§ 26. Entity responsible for a biobank
Each research biobank must have a responsible person in charge who has a degree in medicine or biology. The person or body responsible for the research shall appoint the person responsible for the biobank.
The Ministry may by regulations decide that certain research biobanks must have a board and more detailed rules, in addition to the person responsible for the biobank.
The person responsible for the biobank, person or body responsible for the research and board must make sure that the research biobank is established and managed in accordance with this Act and other legislation.
§ 27. Requirements concerning storage and processing
The material in research biobanks must be stored and processed properly. Storage and processing must be done with respect for the donor of the material.
Human biological material from research biobanks may not be surrendered for insurance purposes, to employers, to the prosecuting authorities or to a court of law even if the person the material originates from consents to this.
The King may by regulations decide that human biological material may be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
The Ministry may by regulations lay down more detailed rules concerning how human biological material in a research biobank shall be stored and processed.
§ 28. Right to use biological material collected by the health service for research
The regional committee for medical and health research ethics may rule that human biological material collected by the health service in connection with diagnosis and treatment may or shall be used for research purposes without the patient’s consent being obtained. This may only be applied if the research in question is of significant interest to society, and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use.
The patient must have been informed in advance that in some cases human biological material may be used for research and must have been given the opportunity to refuse to be involved in research on human biological material.
An electronic register must be established with the details of the patients that have stated that they do not wish their biological material to be used for research.
§ 29. Transfer of human biological material to and from foreign countries
Human biological material from a research biobank may only be sent out of Norway or brought into Norway after approval by the regional committee for medical and health research ethics and when it can be proven that the requirements in Chapter 4 and the requirements concerning processing of personal health data in Chapter 7 have been fulfilled.
The Ministry may by regulations allow exemption from the approval requirement for transfer of biobank material that is part of an ordinary international collaboration.
The Ministry may by regulations stipulate conditions for import and export of human biological material and concerning use of material from abroad for research in Norway.
§ 30. Discontinuation, closure or takeover of research biobanks
The person or body responsible for the research must apply to the regional committee for medical and health research ethics for permission to discontinue, close or transfer a research biobank. The regional committee for medical and health research ethics must approve the procedure in the event of destruction of material.
The Ministry may by regulations lay down provisions that in certain cases human biological material can be transferred to other persons or bodies responsible for the research instead of being destroyed.
§ 31. Other parties’ access to material in a research biobank
The person or body responsible for the research must grant other researchers access to human biological material in the enterprise’s research biobanks, unless the person or body responsible for the research needs the material or other exceptional grounds exist. Before material can be surrendered, the necessary approvals pursuant to Chapter 3 must have been obtained.
The assessment of whether there are exceptional grounds pursuant to the first paragraph must attach importance to the quality and relevance of the research in relation to the purpose of the research biobank. Importance must be attached to statutory duties concerning storage and processing of the material, consideration of the donor of the material and the person or body responsible for the research’s need for the material.
If the person responsible for the research biobank denies the request for access, this decision can be appealed to the regional committee for medical and health research ethics that approved establishment of the research biobank. The committee’s decision is final.
Chapter 7. Research using personal health data
§ 32. Main rule on processing personal health data
The processing of personal health data in medical and health research must have expressly indicated objectives. The personal health data must be relevant and necessary to achieve the objective of the research project. The degree of personal identification in the health data must not be greater than is necessary to serve the intended purposes.
Personal health data may not be used for purposes that are incompatible with the original objective without the consent of the research participant, unless otherwise laid down in law.
Personal health data may not be surrendered for insurance purposes, to employers, to the prosecuting authorities or to a court of law even if the person the data originate from consents to this.
The King may by regulations decide that personal health data may be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
§ 33. Requirements concerning authority to process data and prior approval
Research projects must have authority to process data. Prior approval from the regional committee for medical and health research ethics in accordance with Chapter 3 is necessary and adequate authority to process personal health data in medical and health research.
Processing of personal health data obtained from health registers pursuant to Sections 7 and 8 of the Health Register Act does not require authorisation pursuant to the first paragraph, unless otherwise follows from regulations pertaining to the registers.
§ 34. Processing of personal health data
Personal health data may be processed, compared and surrendered in keeping with the objective of the research project, any consents, authority to process data pursuant to Section 33 and in accordance with the research protocol.
In the event of approval pursuant to Chapter 3, the regional committee for medical and health research ethics may deny comparison or surrender of data if this is deemed to be medically or ethically unsatisfactory.
Personal health data may be compared and surrendered to the person responsible for data processing or a person or body responsible for the research who has special authorisation to receive and process these data. Authority of this nature may be a licence or statutory provisions in legislation or regulations.
§ 35. Access to use personal health data collected by the health service for research
The regional committee for medical and health research ethics may decide that personal health data can or shall be handed over by health personnel for use in research, and that this may be done notwithstanding the duty of confidentiality. The same applies to data gathered by the health service. This may only be applied if the research in question is of significant interest to society, and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use. The rules on the duty of confidentiality pursuant to Section 7 apply accordingly to the party that receives the data.
The Ministry may by regulations issue further provisions concerning the use of confidential information in research.
§ 36. Correction of personal health data, etc.
The project manager shall on his/her own initiative correct incorrect information, update obsolete information and supplement incomplete information.
Incorrect and obsolete information must be deleted or changed in a way that allows the change(s) to be tracked. Incorrect and obsolete information may only be permanently deleted if this is required by someone whom the information may have a direct impact on and the deletion will not have a decisive effect on the validity or representativeness of the research data.
The project manager makes the final decision on a request to have data deleted. If deletion is denied, the decision may be appealed to the regional committee for medical and health research ethics.
§ 37. Data transfer to and from nations outside the EEA Area
Person-identifiable personal health data that are processed as part of a research project may only be transferred between Norway and a non-EEA nation if the following conditions are satisfied:
a) the overseas person in charge of data processing assures the person or body responsible for the research in writing that data have been processed or will be processed in conformance with Directive 95/46/EC, and
b) the person the data pertains to has given their consent, or
c) the registered person has not stated that they do not wish to be involved in research, and they have been informed that the data will be transferred to a nonEEA nation.
Personal health data that have been anonymised or given a pseudonym may be transferred to non-EEA nations if the data cannot be linked to personal identification as long as the data are in the nation in question.
The Ministry may issue regulations on use of personal health data from abroad for research in Norway.
§ 38. Prohibition against storing unnecessary personal health data
Data must not be stored for longer than is necessary to complete the project. The regional committee for medical and health research ethics may rule that documents that are necessary for auditing the project must be kept for five years after the final report on the research project has been sent to the Committee. If the data are not going to be kept thereafter in accordance with the Archives Act or other legislation, they must be anonymised or deleted.
The regional committee for medical and health research ethics may rule that data shall be kept for longer than follows from the first paragraph. Conditions may be attached to this kind of ruling.
The Ministry may issue regulations on storage of data after completion of the research project.
Chapter 8. Transparency and right of access to the research
§ 39. Transparency
The person or body responsible for the research and the project manager must ensure transparency in and around the research.
§ 40. Right of access for research participants
The research participants have the right to access to person-identifiable and pseudonym personal health data about themselves and information about the security measures used in connection with processing personal health data as long as such access does not jeopardise security. The data that access is granted to must be presented in a way that is adapted to the capabilities and the needs of the individual. Research participants may demand that the project manager explains the data mentioned in the first paragraph in more detail, to the extent this is necessary for the research participant to be able to safeguard his/her own interests.
§ 41. Public right of access
Anyone who contacts the regional committee for medical and health research ethics shall be informed about which research projects pursuant to this Act a particular person or body responsible for the research or project manager is or has been involved in and objective of the project.
§ 42. Exceptions to the right of access
The right of access pursuant to Sections 40 and 41 does not cover data that a) if they become known, they might pose a risk to national security, national defence or damage relations with foreign powers or international organisations, b) it is required to keep secret in the interests of prevention, investigation, disclosure and judicial prosecution of criminal acts, c) it must be regarded as inadvisable that the research participant acquires knowledge of, in the interests of the person concerned’s health or relationship with people close to the participant in question, d) are subject to a duty of confidentiality, e) only exist in text prepared for internal processing and that has not been surrendered to others, or f) it would be contrary to obvious and fundamental private or public interests to inform about, including the interests of the research participant him/herself. Information that the research participant is refused access to pursuant to the first paragraph, litra c, may be accessed by a representative of the research participant, unless the representative is regarded as unfit for this task. A doctor or lawyer may not be refused access to information, unless exceptional grounds suggest otherwise.
If access is denied pursuant to the first or second paragraph, the grounds for this decision must be stated in writing with reference to the exemption authorisation.
Denied demands for access and information can be appealed to the regional committee for medical and health research ethics.
§ 43. Time limit on the right of access
The project manager shall respond to inquiries pursuant to Sections 40 and 41 without any undue delay and at the latest within 30 days from the inquiry being received. If exceptional circumstances render it impossible to respond to an inquiry within 30 days, processing may be postponed until it is possible to respond. In this case, the project manager must provide an interim answer containing information about the grounds for the delay and the date when it is expected that an answer can be given.
§ 44. Public register of research projects and research biobanks
The regional committee for medical and health research ethics shall keep a systematic register of ongoing and completed research projects based on information in applications and final reports, cf. Sections 10, 11 and 12. These registers must be public.
The regional committee for medical and health research ethics shall enter all research biobanks in the Norwegian Institute of Public Health’s Biobank Register.
§ 45. Deferred publication
The person or body responsible for the research and the project manager can apply to the regional committee for medical and health research ethics for deferred publication in cases where this is necessary to protect legitimate interests linked to patents or competition, or in the interests of ongoing research. It must be indicated when the data will be published.
The regional committee for medical and health research ethics may decide that sensitive information about a project shall not be recorded in the register pursuant to Section 44 or that access may not be demanded pursuant to Sections 40 and 41 for a clearly defined period, if publication might damage significant private or public interests. In this case, the Committee must in its rejection of an application for access provide information about when access may be granted. Only in exceptional cases may this period be extended.
Chapter 9. Supervision
§ 46. The authority of the Norwegian Board of Health Supervision
The Norwegian Board of Health Supervision oversees medical and health research and the management of research biobanks.
§ 47. The authority of the Norwegian Data Inspectorate
The Norwegian Data Inspectorate oversees use of personal health data pursuant to this Act.
§ 48. Duty to inform the regulatory authorities
The person or body responsible for the research, the project manager and other personnel involved in a research project must allow the regulatory authorities access to the enterprise’s premises and notwithstanding the duty of confidentiality give and make available to the regulatory authorities all the information, documents, materials, etc. deemed necessary for the exercise of supervision of medical and health research.
§ 49. The regulatory authorities’ duty of confidentiality
The regulatory authorities and others who perform services for the regulatory authorities have a duty of confidentiality pursuant to Section 7. This duty of confidentiality also covers information about security measures. Chapter 10. Compensation, orders, penalties, etc.
§ 50. Compensation
The rules in the Patient Injury Act apply accordingly to injuries that arise under medical trials.
The person or body responsible for the research must compensate injuries that arise as a result of human biological material or personal health data being processed in a manner that contravenes provisions in or pursuant to this Act, unless it can be proven that the injury was not due to errors or negligence on the part of the person or body responsible for the research.
The compensation must correspond to the financial loss that the injured person has incurred as a result of the unlawful processing of their human biological material or personal health data. The person in charge of data processing may also be ordered to pay reasonable compensation for injuries of a non-financial nature (compensation for non-pecuniary loss).
Private persons or bodies responsible for the research must provide security through insurance for the financial liability that may arise pursuant to the second and third paragraphs.
The Ministry may by regulations issue further provisions concerning the duty to have insurance.
§ 51. The Norwegian Board of Health Supervision’s right to issue orders concerning correction, discontinuation, etc.
If research projects or research biobanks are being run in a way that can have harmful consequences for research participants or others, or in some other way are unfortunate or unsound, the Norwegian Board of Health Supervision can order that the matter must be rectified. If the Norwegian Board of Health Supervision deems it necessary, it may order that the research project is discontinued or the research biobank is closed. The Ministry can assume further management.
The rules concerning appeals and reversing decisions in Chapter VI of the Public Administration Act apply accordingly to orders pursuant to the first paragraph. The appeal shall have suspensive effect, unless the Norwegian Board of Health Supervision decides that the decision shall have immediate effect.
The other regulatory authorities under whose area of responsibility the research project falls must be informed of orders issued by the Norwegian Board of Health Supervision.
§ 52. The Norwegian Data Inspectorate’s right to issue orders concerning correction, discontinuation, etc.
The Norwegian Data Inspectorate may issue orders that processing of personal health data that is in contravention of provisions in or pursuant to this Act must stop or stipulate conditions that must be fulfilled to ensure that personal health data are processed in accordance with this Act.
Decisions that the Norwegian Data Inspectorate makes pursuant to this provision can be appealed to the Data Protection Tribunal Norway.
The Norwegian Board of Health Supervision must be informed about orders issued by the Norwegian Data Inspectorate.
§ 53. Coercive fines
The Norwegian Board of Health Supervision and the Norwegian Data Inspectorate may impose a coercive fine to accrue for each day, week or month after expiry of the time limit set for compliance with an order pursuant to Section 51 or 52, until the order has been complied with. Coercive fines may also be imposed as a single-payment fine.
The Norwegian Board of Health Supervision and the Norwegian Data Inspectorate may waive an accrued coercive fine. The coercive fine does not start to accrue until the time limit for appeals has expired. If the decision is appealed, the coercive fine does not start to accrue until such time as decided by the appeal body.
Outstanding contributions to cover expenses are enforceable by attachment.
§ 54. Penalties
Anyone who wilfully or through gross negligence violates or is complicit in violation of provisions laid down in this Act or provisions laid down pursuant to this Act shall be liable to fines or imprisonment not exceeding one year or both.
If there are particularly aggravating circumstances, a sentence of imprisonment of up three years may be imposed. When deciding whether particularly aggravating circumstances exist, weight shall be accorded to, among other things, the risk of major injury or inconvenience for the research participant, the anticipated gain of the violation, the duration and scope of the violation, manifest culpability, and whether the person in question has previously been convicted for violation of corresponding provisions.
Chapter 11. Final provisions
§ 55. Entry into force and transitional rules
This Act shall come into force from such time as decided by the King. The King may decide that the individual provisions in the Act shall enter into force at different times.
The King may issue transitional rules in regulations.
§ 56. Amendments to other Acts
1. The following amendments shall be made to the Act of 21 February 2003 no. 12 relating to biobanks (the Biobanks Act):
The name of the Act shall be changed to:
Act of 21 February 2003 no. 12 relating to clinical biobanks (the Clinical Biobanks Act)
Section 1, second paragraph shall read:
This Act shall ensure that material in a biobank can be used for health-related purposes, including diagnosis, treatment and teaching in a way that meets satisfactory ethical standards.
Section 2, second paragraph is repealed. The current third and fourth paragraphs will become the new second and third paragraphs.
Section 2, third paragraph shall read:
The term donor as used in this Act means a person who provides biological material for inclusion in a diagnostic biobank or treatment biobank.
Section 3, third paragraph shall read: Biological material that is taken for the purpose of medical examination, diagnosis and treatment and that is destroyed shortly afterwards does not come within the scope of this Act.
Section 3, new fourth paragraph shall read: This Act does not apply to human biological material and health and personal data derived from human biological material that is being used or is going to be used in research. The collection, storage, processing and destruction of human biological material and data for research purposes are governed by the Health Research Act.
Section 4 is repealed.
Section 5, first paragraph shall read: The Ministry shall be notified of any biobank established for the purpose of diagnosis and treatment. Such notification shall be sent to the Ministry within two months of the establishment of the biobank. The notification shall include information on: 1. the purpose for which the biobank is to be established,
2. the type of material it is to contain and how the material is to be collected,
3. which and how many people material has been or is to be collected from,
4. how consent is to be obtained and what information donors will be given in advance,
5. the length of time for which the biobank is to be maintained and what will be done with the material when it is closed down,
6. the security measures related to operation of the biobank,
7. the person in charge of the biobank pursuant to Section 7 and the data controller or controller pursuant to the Personal Health Data Filing System Act and Personal Data Act, and
8. how the biobank is to be financed and whether any financial gain will be made from the material in the biobank.
Section 5, second paragraph shall read:
The provisions of the Health Research Act apply if material from a biobank established for the purpose of diagnosis and treatment is to be used for research.
Section 10, fourth paragraph is repealed.
Section 12 is repealed.
Section 13, first paragraph shall read: If previously collected material and data are to be put to different, wider or new use that does not fall within the scope of the original consent, new voluntary, express and informed consent shall be obtained, unless otherwise follows from the Act on medical and health research.
Section 13, second, third and fourth paragraphs are repealed.
Section 14, first paragraph shall read: Any person who has given their consent pursuant to Sections 11 and 13 may withdraw such consent at any time.
Section 14, second paragraph, second sentence is repealed. Section 15, first paragraph, first sentence shall read: If the consent of the donor has been obtained in accordance with Sections 11 and 13, others may be granted access to the biological material in a biobank or to specified parts of the material. Section 15, third paragraph is repealed.
Section 15, new last paragraph shall read:
The King may by regulations decide that human biological material can be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
Section 18, first paragraph, first sentence shall read:
The Ministry may issue orders to a biobank or stop its further operation if it is being run in contravention of this Act or if the scope of its activities falls outside what has been notified to the Ministry in accordance with Section 5. 2.
2. The following amendments shall be made to Act of 18 May 2001 no. 24 on personal health data filing systems and the processing of personal health data (the Personal Health Data Filing System Act):
Section 3, new fourth paragraph shall read: This Act does not apply to the processing of personal health data that is regulated by the Health Research Act.
Section 5, first paragraph shall read:
Personal health data may only be processed by automatic means when this is permitted pursuant to Sections 9 and 33 of the Personal Data Act, the Health Research Act or it is so provided by statute and is not prohibited on other special legal grounds. The same applies to other processing of personal health data, if the data are part of or are intended to be part of a personal health data filing system.
CONTENTS
Act on medical and health research (the Health Research Act)
Chapter 1. Purpose and scope of the Act
§ 1. Purpose of the Act
§ 2. Substantive scope of the Act
§ 3. Territorial scope of the Act
§ 4. Definitions
Chapter 2. Requirements concerning organisation and execution of medical and health research
§ 5. Responsible conduct
§ 6. Main requirements on organisation of research
§ 7. Duty of confidentiality
§ 8. Commercial exploitation
Chapter 3. Application and duty to notify the Regional Committee for Medical and Health Research Ethics
§ 9. Requirements concerning prior approval
§ 10. Application for prior approval
§ 11. Application to make substantial changes to a research project
§ 12. Final report and reports
Chapter 4. Consent
§ 13. Main rule on consent
§ 14. Broad consent
§ 15. New or changed use of collected human biological material or personal health data
§ 16. Withdrawal of consent
§ 17. Competence to give consent
§ 18. Conditions for research including people who lack competence to give their consent
§ 19. Consent to research in clinical emergencies
§ 20. Anonymous human biological material and personal health data
§ 21. Research on human biological material from deceased persons
Chapter 5. Research involving people
§ 22. General provisions concerning research on people
§ 23. Duty to report adverse medical incidents §
24. Duty to provide information to participants in connection with injury etc.
Chapter 6. Research biobanks and research involving human biological material
§ 25. Establishment of research biobanks
§ 26. Entity responsible for a biobank
§ 27. Requirements concerning storage and processing
§ 28. Right to use biological material collected by the health service for research
§ 29. Transfer of human biological material to and from foreign countries
§ 30. Discontinuation, closure or takeover of research biobanks
§ 31. Other parties’ access to material in a research biobank
Chapter 7. Research using personal health data
§ 32. Main rule on processing personal health data
§ 33. Requirements concerning authority to process data and prior approval
§ 34. Processing of personal health data
§ 35. Access to use personal health data collected by the health service for research
§ 36. Correction of personal health data, etc.
§ 37. Data transfer to and from nations outside the EEA Area
§ 38. Prohibition against storing unnecessary personal health data
Chapter 8. Transparency and right of access to the research
39. Transparency
§40. Right of access for research participants
§ 41. Public right of access
§ 42. Exceptions to the right of access
§ 43. Time limit on the right of access
§ 44. Public register of research projects and research biobanks
§ 45. Deferred publication Chapter
Chapter 9. Supervision
§ 46. The authority of the Norwegian Board of Health Supervision
§ 47. The authority of the Norwegian Data Inspectorate
§ 48. Duty to inform the regulatory authorities
§ 49. The regulatory authorities’ duty of confidentiality
Chapter 10. Compensation, orders, penalties, etc.
§ 50. Compensation
§ 51. The Norwegian Board of Health Supervision’s right to issue orders concerning correction, discontinuation, etc.
§ 52. The Norwegian Data Inspectorate’s right to issue orders concerning correction, discontinuation, etc.
§ 53. Coercive fines
§ 54. Penalties Chapter 11. Final provisions
§ 55. Entry into force and transitional rules
§ 56. Amendments in other Acts of law
Act on medical and health research (the Health Research Act)
Chapter 1. Purpose and scope of the Act
§ 1. Purpose
The purpose of the Act is to promote good and ethically sound medical and health research.
§ 2. Substantive scope of the Act
The Act applies to all medical and health research on human beings, human biological material or personal health data. Such research also includes pilot studies and experimental treatments.
The Act does not apply to establishment of health registers.
Unless otherwise provided by this Act, the Personal Data Act and appurtenant regulations apply as supplementary provisions. Clinical testing of medicinal products on human beings is covered by Section 3 of the Medicines Act and appurtenant regulations. Clinical testing of medical equipment is covered by the Act on Medical Equipment and appurtenant regulations. In this context, the provisions of this Act apply as a supplement, where relevant.
The Ministry may by regulations lay down provisions concerning the application of the Act in special areas within medical and health research.
§ 3. Territorial scope of the Act
The Act applies to research conducted on Norwegian territory or if the research is being done under the direction of a person or body responsible for the research established in Norway.
The Act does not apply to use of personal health data if the person or body responsible for the research is established in another EEA State. Nor does the Act apply to use of personal health data if the person or body responsible for the research is established in a state outside the EEA Area and the institution does not use tools in Norway for purposes other than pure transfer of personal health data.
The King may by regulations decide the extent to which the Act will be applied in Svalbard and Jan Mayen.
§ 4. Definitions
For the purposes of this Act, the following definitions shall apply:
a) medical and health research: activity conducted using scientific methods to generate new knowledge about health and disease,
b) human biological material: organs, parts of organs, cells and tissues and components of this kind of material from living and deceased human beings,
c) research biobank: a collection of human biological material that is used in a research project or that is going to be used for research,
d) personal health data: confidential information pursuant to Section 21 of the Health Personnel Act and other information and assessments concerning health issues or that are significant for health issues that can be linked to an individual person,
e) person or body responsible for the research: institution or some other legal or physical person who has the overall responsibility for the research project and who has the necessary capabilities to be able to fulfil the duties ascribed to the person or body responsible for the research pursuant to this Act,
f) project manager: a physical person who is responsible for the day-to-day operation of the research project and who has the necessary research qualifications and experience to be able to fulfil the duties ascribed to the project manager pursuant to this Act.
Chapter 2. Requirements concerning organisation and execution of medical and health research
§ 5. Responsible conduct
Medical and health research must be organised and carried out in a responsible manner.
Research must be based on respect for the research participants’ human rights and dignity. The participants’ welfare and integrity shall have priority over scientific and social interests.
Medical and health research must take into account ethical, medical, health, scientific and privacy factors.
§ 6. Main requirements on organisation of research
Medical and health research must be organised as a project under the direction of a person or body responsible for the research and managed by a project manager and must be described in a research protocol.
The sources of funding must be indicated in the protocol. Internal control must be carried out in a manner that is adapted to the size, nature, activities and risk factors of the research.
The Ministry may lay down regulations with further requirements concerning the organisation of medical and health research, requirements concerning the research protocol and concerning internal control, and may also lay down provisions concerning the duties of the project manager and the person or body responsible for the research.
§ 7. Duty of confidentiality
Any party that has access to personal health data and other personal data that are used in a research project must prevent other people from gaining access to or knowledge of the data.
The duty of confidentiality does not impede the information being communicated to the person it concerns directly or being surrendered when the recipient has legal grounds for having the information disclosed, cf. Section 13.
§ 8. Commercial exploitation
Commercial exploitation of research participants, human biological material and personal health data in general is prohibited.
Chapter 3. Application and duty to notify the regional committee for medical and health research ethics
§ 9. Requirements concerning prior approval
The research project must be approved in advance by the regional committee for medical and health research ethics, cf. Section 4 of Act of 30 June 2006 no. 56 on ethics and integrity in research.
§ 10. Application for prior approval
An application for prior approval of a research project must be submitted with the research protocol to the regional committee for medical and health research ethics.
The regional committee for medical and health research ethics undertakes a standard evaluation of the research ethics of the project and judges whether the project satisfies the requirements laid down in this Act or pursuant to this Act. The regional committee for medical and health research ethics may specify conditions for approval.
Decisions regarding prior approval of the research project may be appealed to the National Committee for Medical and Health Research Ethics, cf. Section 4 of Act of 30 June 2006 no. 56 on ethics and integrity in research.
The Ministry may issue regulations containing requirements concerning the application, time limits for the regional committee for medical and health research ethics’ consideration of applications and more detailed conditions for prior approval.
§ 11. Application to make substantial changes to a research project
If the project manager wants to make substantial changes to the objective, method, schedule or organisation of the research project, an application must be submitted to the regional committee for medical and health research ethics that has granted prior approval. The application must describe the proposed changes and the reasons for them.
The regional committee for medical and health research ethics decides whether the application is granted or denied. If the changes to the project are so great that it needs to be regarded as a new project, the regional committee for medical and health research ethics may decide that prior approval must be applied for in accordance with Section 9 (cf. Section 10) again.
The Ministry may issue regulations containing requirements concerning processing of applications and time limits for the processing of applications.
§ 12. Final report and reports
The project manager must submit a final report to the regional committee for medical and health research ethics when the research project is finished. The final report must present the findings objectively and methodically, ensuring that both positive and negative findings are presented.
The regional committee for medical and health research ethics may stipulate requirements regarding the content of the final report.
The regional committee for medical and health research ethics may order the project manager to submit annual or extraordinary reports, if the Committee deems it necessary.
Chapter 4. Consent
§ 13. Main rule on consent
Consent must be obtained from participants in medical and health research, unless otherwise laid down in law.
Consent must be informed, voluntary, express and documented. Consent must be based on specific information about a concrete research project, unless there is a case for granting broad consent, cf. Section 14.
If the research participant can be regarded as being in a relationship of dependency with the person requesting consent, meaning that the research participant might feel pressured to give their consent, informed consent must be obtained by another person whom the research participant does not have this kind of relationship with.
The Ministry may lay down regulations concerning consent.
§ 14. Broad consent
Pursuant to Section 13, research participants may consent to human biological material and personal health data being used for specific, broadly defined research purposes.
The regional committee for medical and health research ethics may specify conditions for use of broad consent and may order the project manager to obtain new consent if the committee deems it necessary.
Participants who have given broad consent are entitled to receive information about the project at regular intervals.
§ 15. New or changed use of collected human biological material or personal health data
In the event of substantial changes to the research project, new consent must be obtained in accordance with Section 13 if the changes are deemed to have consequences for the participant’s consent.
If it is difficult to obtain new consent, the regional committee for medical and health research ethics may approve new or changed use of previously collected human biological material or personal health data without new consent being obtained. This may only be applied if the research in question is of significant interest to society and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use.
§ 16. Withdrawal of consent
Consent to take part in a research project may be withdrawn at any time.
If a participant withdraws his/her consent, research on their biological material or personal health data must stop. A person who has withdrawn their consent may demand that their biological material is destroyed and that the personal health data are deleted or surrendered within 30 days.
The right to demand destruction, deletion or surrender of biological material or health data pursuant to the second paragraph does not apply if the material or data have been anonymised, if the material has been processed and is now part of another biological product, or if the data have already been included in completed analyses.
If particularly strong social or research considerations so warrant, the regional committee for medical and health research ethics may allow continued research on the material and defer destruction, deletion or surrender until the research project is concluded.
§ 17. Competence to give consent
The following people are entitled to consent to take part in medical and health research:
a) legally competent persons
b) minors aged 16 and over, unless otherwise follows from statutory provisions or the nature of the activity.
Competence to give consent pursuant to the first paragraph may cease to apply in the situations referred to in Section 4-3, second paragraph of the Patients’ Rights Act. Consent must be obtained from parents or other people with parental responsibility for research using minors aged 16–18 that entails bodily intervention or testing medicinal products.
The rules concerning consent stipulated in Section 4-4 of the Patients’ Rights Act apply correspondingly to consent to research including participants under the age of 16. If children between the ages of 12 and 16 do not want their parents, others with parental responsibility for them or the child welfare service to be informed about personal data relating to the child, for valid reasons, this wish must be respected.
For persons who lack competence to give consent pursuant to Section 4-3, second paragraph of the Patients’ Rights Act, the person’s next-of-kin as defined in Section 1-3, litra b of the Patients’ Rights Act shall have authority to grant consent.
Section 4-7 of the Patients’ Rights Act applies correspondingly to people who have been declared legally incapable of managing his or her own affairs pursuant to Act of 28 November 1898 relating to declaring a person incapable of managing his own affairs.
The Ministry may by regulations decide that for special types of research projects children between the ages of 12 and 16 may themselves consent to research on personal health data. The Ministry may lay down more detailed rules in regulations regarding the conditions for this kind of consent.
§ 18. Conditions for research including people who lack competence to give their consent
Research that includes minors and people who lack competence to give consent pursuant to Section 4-3 of the Patients’ Rights Act may only be done if the following conditions are met:
a) the potential risks or disadvantages for the person are insignificant,
b) the individual involved is not averse to it, and
c) there is reason to assume that the results of the research may be of use to the person concerned or other people with the same age-specific disorder, disease, injury or condition.
For minors, it is a requirement that similar research cannot be done on people who are not minors.
For people who lack competence to give their consent, it is a requirement that there is no reason to believe that the person concerned would have been averse to participating in the research project if they had had the capacity to give their consent, and that similar research cannot be done on people who have the capacity to give consent.
§ 19. Consent to research in clinical emergencies
In clinical emergencies where the patient is not capable of giving their consent and it is impossible to obtain consent from the person’s next-of-kin, research may only take place if the following conditions are satisfied:
a) the potential risks or disadvantages for the person are insignificant,
b) the individual involved is not averse to it and there is no reason for researchers or other personnel to believe that the person concerned would have been averse to participating in the research project if they had had the capacity to give their consent,
c) it is only possible to carry out the research in clinical emergency situations, and
d) the research is justified beyond any doubt on grounds of the prospect of results with major preventive, diagnostic or therapeutic value.
The research participant or their next-of-kin must be given information about the research at the first opportunity. Consent pursuant to Section 13 (cf. Section 17) is a prerequisite for further research and must be obtained without delay.
§ 20. Anonymous human biological material and personal health data
Consent is not required for research on anonymous human biological material and anonymous data. Consent pursuant to this chapter is required to collect material and data for subsequent anonymisation.
§ 21. Research on human biological material from deceased persons
Research on biological material taken from deceased persons is correspondingly subject to the provisions in Act of 9 February 1973 no. 6 relating to transplantation, hospital autopsies and the donation of bodies etc. and regulations issued pursuant to this Act.
Chapter 5. Research involving people
§ 22. General provisions concerning research on people
Research may only be done on people if there are no alternative methods that are approximately equally effective.
Before research is carried out on people, the risk and hazards for the participants must be thoroughly evaluated. They must be proportional to the expected advantages for the research participant personally or for other people.
Research must stop if it is found that the risk is greater than the possible advantages or if there are adequate grounds for positive, beneficial results.
Research may only be combined with treatment if the research is assumed to have health-promoting value for the research participant. The advantages, risks, disadvantages and effectiveness of a new method must be tested against the best methods for prevention, diagnosis and treatment that are currently available, unless especially compelling considerations dictate otherwise.
§ 23. Duty to report adverse medical incidents
The project manager must immediately notify the regulatory authorities in writing about serious adverse and unexpected medical incidents that are assumed to be linked to the research.
The project manager, other researchers and other personnel shall on their own initiative inform the regulatory authorities about factors that may jeopardise the safety of the research participants. The police must be notified immediately in the event of death from unnatural causes.
§ 24. Duty to provide information to participants in connection with injury etc.
The project manager must inform the research participants immediately if they have been injured or if complications have arisen as a result of the research project.
At the same time, the project manager must inform the research participant about his/her right to seek compensation from the Norwegian System of Compensation to Patients NPE1 and other insurance schemes.
Chapter 6. Research biobanks and research involving human biological material
§ 25. Establishment of research biobanks
A research biobank may only be established after approval by the regional committee for medical and health research ethics.
Research biobanks that are established in connection with collection, storage and use of human biological material as part of a research project must be described in the project’s research protocol.
Research biobanks that are established in connection with collection, storage and use of human biological material without affiliation to a concrete research project must be approved by the regional committee for medical and health research ethics. The same applies to research biobanks that are going to be used for storage and new use of human biological material once the original objective of a research project has been fulfilled.
The Ministry may by regulations issue provisions concerning what applications for establishment of research biobanks must include.
The Ministry may by regulations issue provisions concerning establishment and other processing of human biological material in biobanks linked to health registers pursuant to Sections 7 and 8 of the Personal Health Data Filing System Act.
§ 26. Entity responsible for a biobank
Each research biobank must have a responsible person in charge who has a degree in medicine or biology. The person or body responsible for the research shall appoint the person responsible for the biobank.
The Ministry may by regulations decide that certain research biobanks must have a board and more detailed rules, in addition to the person responsible for the biobank.
The person responsible for the biobank, person or body responsible for the research and board must make sure that the research biobank is established and managed in accordance with this Act and other legislation.
§ 27. Requirements concerning storage and processing
The material in research biobanks must be stored and processed properly. Storage and processing must be done with respect for the donor of the material.
Human biological material from research biobanks may not be surrendered for insurance purposes, to employers, to the prosecuting authorities or to a court of law even if the person the material originates from consents to this.
The King may by regulations decide that human biological material may be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
The Ministry may by regulations lay down more detailed rules concerning how human biological material in a research biobank shall be stored and processed.
§ 28. Right to use biological material collected by the health service for research
The regional committee for medical and health research ethics may rule that human biological material collected by the health service in connection with diagnosis and treatment may or shall be used for research purposes without the patient’s consent being obtained. This may only be applied if the research in question is of significant interest to society, and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use.
The patient must have been informed in advance that in some cases human biological material may be used for research and must have been given the opportunity to refuse to be involved in research on human biological material.
An electronic register must be established with the details of the patients that have stated that they do not wish their biological material to be used for research.
§ 29. Transfer of human biological material to and from foreign countries
Human biological material from a research biobank may only be sent out of Norway or brought into Norway after approval by the regional committee for medical and health research ethics and when it can be proven that the requirements in Chapter 4 and the requirements concerning processing of personal health data in Chapter 7 have been fulfilled.
The Ministry may by regulations allow exemption from the approval requirement for transfer of biobank material that is part of an ordinary international collaboration.
The Ministry may by regulations stipulate conditions for import and export of human biological material and concerning use of material from abroad for research in Norway.
§ 30. Discontinuation, closure or takeover of research biobanks
The person or body responsible for the research must apply to the regional committee for medical and health research ethics for permission to discontinue, close or transfer a research biobank. The regional committee for medical and health research ethics must approve the procedure in the event of destruction of material.
The Ministry may by regulations lay down provisions that in certain cases human biological material can be transferred to other persons or bodies responsible for the research instead of being destroyed.
§ 31. Other parties’ access to material in a research biobank
The person or body responsible for the research must grant other researchers access to human biological material in the enterprise’s research biobanks, unless the person or body responsible for the research needs the material or other exceptional grounds exist. Before material can be surrendered, the necessary approvals pursuant to Chapter 3 must have been obtained.
The assessment of whether there are exceptional grounds pursuant to the first paragraph must attach importance to the quality and relevance of the research in relation to the purpose of the research biobank. Importance must be attached to statutory duties concerning storage and processing of the material, consideration of the donor of the material and the person or body responsible for the research’s need for the material.
If the person responsible for the research biobank denies the request for access, this decision can be appealed to the regional committee for medical and health research ethics that approved establishment of the research biobank. The committee’s decision is final.
Chapter 7. Research using personal health data
§ 32. Main rule on processing personal health data
The processing of personal health data in medical and health research must have expressly indicated objectives. The personal health data must be relevant and necessary to achieve the objective of the research project. The degree of personal identification in the health data must not be greater than is necessary to serve the intended purposes.
Personal health data may not be used for purposes that are incompatible with the original objective without the consent of the research participant, unless otherwise laid down in law.
Personal health data may not be surrendered for insurance purposes, to employers, to the prosecuting authorities or to a court of law even if the person the data originate from consents to this.
The King may by regulations decide that personal health data may be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
§ 33. Requirements concerning authority to process data and prior approval
Research projects must have authority to process data. Prior approval from the regional committee for medical and health research ethics in accordance with Chapter 3 is necessary and adequate authority to process personal health data in medical and health research.
Processing of personal health data obtained from health registers pursuant to Sections 7 and 8 of the Health Register Act does not require authorisation pursuant to the first paragraph, unless otherwise follows from regulations pertaining to the registers.
§ 34. Processing of personal health data
Personal health data may be processed, compared and surrendered in keeping with the objective of the research project, any consents, authority to process data pursuant to Section 33 and in accordance with the research protocol.
In the event of approval pursuant to Chapter 3, the regional committee for medical and health research ethics may deny comparison or surrender of data if this is deemed to be medically or ethically unsatisfactory.
Personal health data may be compared and surrendered to the person responsible for data processing or a person or body responsible for the research who has special authorisation to receive and process these data. Authority of this nature may be a licence or statutory provisions in legislation or regulations.
§ 35. Access to use personal health data collected by the health service for research
The regional committee for medical and health research ethics may decide that personal health data can or shall be handed over by health personnel for use in research, and that this may be done notwithstanding the duty of confidentiality. The same applies to data gathered by the health service. This may only be applied if the research in question is of significant interest to society, and the participants’ welfare and integrity are ensured. The regional committee for medical and health research ethics may specify conditions for use. The rules on the duty of confidentiality pursuant to Section 7 apply accordingly to the party that receives the data.
The Ministry may by regulations issue further provisions concerning the use of confidential information in research.
§ 36. Correction of personal health data, etc.
The project manager shall on his/her own initiative correct incorrect information, update obsolete information and supplement incomplete information.
Incorrect and obsolete information must be deleted or changed in a way that allows the change(s) to be tracked. Incorrect and obsolete information may only be permanently deleted if this is required by someone whom the information may have a direct impact on and the deletion will not have a decisive effect on the validity or representativeness of the research data.
The project manager makes the final decision on a request to have data deleted. If deletion is denied, the decision may be appealed to the regional committee for medical and health research ethics.
§ 37. Data transfer to and from nations outside the EEA Area
Person-identifiable personal health data that are processed as part of a research project may only be transferred between Norway and a non-EEA nation if the following conditions are satisfied:
a) the overseas person in charge of data processing assures the person or body responsible for the research in writing that data have been processed or will be processed in conformance with Directive 95/46/EC, and
b) the person the data pertains to has given their consent, or
c) the registered person has not stated that they do not wish to be involved in research, and they have been informed that the data will be transferred to a nonEEA nation.
Personal health data that have been anonymised or given a pseudonym may be transferred to non-EEA nations if the data cannot be linked to personal identification as long as the data are in the nation in question.
The Ministry may issue regulations on use of personal health data from abroad for research in Norway.
§ 38. Prohibition against storing unnecessary personal health data
Data must not be stored for longer than is necessary to complete the project. The regional committee for medical and health research ethics may rule that documents that are necessary for auditing the project must be kept for five years after the final report on the research project has been sent to the Committee. If the data are not going to be kept thereafter in accordance with the Archives Act or other legislation, they must be anonymised or deleted.
The regional committee for medical and health research ethics may rule that data shall be kept for longer than follows from the first paragraph. Conditions may be attached to this kind of ruling.
The Ministry may issue regulations on storage of data after completion of the research project.
Chapter 8. Transparency and right of access to the research
§ 39. Transparency
The person or body responsible for the research and the project manager must ensure transparency in and around the research.
§ 40. Right of access for research participants
The research participants have the right to access to person-identifiable and pseudonym personal health data about themselves and information about the security measures used in connection with processing personal health data as long as such access does not jeopardise security. The data that access is granted to must be presented in a way that is adapted to the capabilities and the needs of the individual. Research participants may demand that the project manager explains the data mentioned in the first paragraph in more detail, to the extent this is necessary for the research participant to be able to safeguard his/her own interests.
§ 41. Public right of access
Anyone who contacts the regional committee for medical and health research ethics shall be informed about which research projects pursuant to this Act a particular person or body responsible for the research or project manager is or has been involved in and objective of the project.
§ 42. Exceptions to the right of access
The right of access pursuant to Sections 40 and 41 does not cover data that a) if they become known, they might pose a risk to national security, national defence or damage relations with foreign powers or international organisations, b) it is required to keep secret in the interests of prevention, investigation, disclosure and judicial prosecution of criminal acts, c) it must be regarded as inadvisable that the research participant acquires knowledge of, in the interests of the person concerned’s health or relationship with people close to the participant in question, d) are subject to a duty of confidentiality, e) only exist in text prepared for internal processing and that has not been surrendered to others, or f) it would be contrary to obvious and fundamental private or public interests to inform about, including the interests of the research participant him/herself. Information that the research participant is refused access to pursuant to the first paragraph, litra c, may be accessed by a representative of the research participant, unless the representative is regarded as unfit for this task. A doctor or lawyer may not be refused access to information, unless exceptional grounds suggest otherwise.
If access is denied pursuant to the first or second paragraph, the grounds for this decision must be stated in writing with reference to the exemption authorisation.
Denied demands for access and information can be appealed to the regional committee for medical and health research ethics.
§ 43. Time limit on the right of access
The project manager shall respond to inquiries pursuant to Sections 40 and 41 without any undue delay and at the latest within 30 days from the inquiry being received. If exceptional circumstances render it impossible to respond to an inquiry within 30 days, processing may be postponed until it is possible to respond. In this case, the project manager must provide an interim answer containing information about the grounds for the delay and the date when it is expected that an answer can be given.
§ 44. Public register of research projects and research biobanks
The regional committee for medical and health research ethics shall keep a systematic register of ongoing and completed research projects based on information in applications and final reports, cf. Sections 10, 11 and 12. These registers must be public.
The regional committee for medical and health research ethics shall enter all research biobanks in the Norwegian Institute of Public Health’s Biobank Register.
§ 45. Deferred publication
The person or body responsible for the research and the project manager can apply to the regional committee for medical and health research ethics for deferred publication in cases where this is necessary to protect legitimate interests linked to patents or competition, or in the interests of ongoing research. It must be indicated when the data will be published.
The regional committee for medical and health research ethics may decide that sensitive information about a project shall not be recorded in the register pursuant to Section 44 or that access may not be demanded pursuant to Sections 40 and 41 for a clearly defined period, if publication might damage significant private or public interests. In this case, the Committee must in its rejection of an application for access provide information about when access may be granted. Only in exceptional cases may this period be extended.
Chapter 9. Supervision
§ 46. The authority of the Norwegian Board of Health Supervision
The Norwegian Board of Health Supervision oversees medical and health research and the management of research biobanks.
§ 47. The authority of the Norwegian Data Inspectorate
The Norwegian Data Inspectorate oversees use of personal health data pursuant to this Act.
§ 48. Duty to inform the regulatory authorities
The person or body responsible for the research, the project manager and other personnel involved in a research project must allow the regulatory authorities access to the enterprise’s premises and notwithstanding the duty of confidentiality give and make available to the regulatory authorities all the information, documents, materials, etc. deemed necessary for the exercise of supervision of medical and health research.
§ 49. The regulatory authorities’ duty of confidentiality
The regulatory authorities and others who perform services for the regulatory authorities have a duty of confidentiality pursuant to Section 7. This duty of confidentiality also covers information about security measures. Chapter 10. Compensation, orders, penalties, etc.
§ 50. Compensation
The rules in the Patient Injury Act apply accordingly to injuries that arise under medical trials.
The person or body responsible for the research must compensate injuries that arise as a result of human biological material or personal health data being processed in a manner that contravenes provisions in or pursuant to this Act, unless it can be proven that the injury was not due to errors or negligence on the part of the person or body responsible for the research.
The compensation must correspond to the financial loss that the injured person has incurred as a result of the unlawful processing of their human biological material or personal health data. The person in charge of data processing may also be ordered to pay reasonable compensation for injuries of a non-financial nature (compensation for non-pecuniary loss).
Private persons or bodies responsible for the research must provide security through insurance for the financial liability that may arise pursuant to the second and third paragraphs.
The Ministry may by regulations issue further provisions concerning the duty to have insurance.
§ 51. The Norwegian Board of Health Supervision’s right to issue orders concerning correction, discontinuation, etc.
If research projects or research biobanks are being run in a way that can have harmful consequences for research participants or others, or in some other way are unfortunate or unsound, the Norwegian Board of Health Supervision can order that the matter must be rectified. If the Norwegian Board of Health Supervision deems it necessary, it may order that the research project is discontinued or the research biobank is closed. The Ministry can assume further management.
The rules concerning appeals and reversing decisions in Chapter VI of the Public Administration Act apply accordingly to orders pursuant to the first paragraph. The appeal shall have suspensive effect, unless the Norwegian Board of Health Supervision decides that the decision shall have immediate effect.
The other regulatory authorities under whose area of responsibility the research project falls must be informed of orders issued by the Norwegian Board of Health Supervision.
§ 52. The Norwegian Data Inspectorate’s right to issue orders concerning correction, discontinuation, etc.
The Norwegian Data Inspectorate may issue orders that processing of personal health data that is in contravention of provisions in or pursuant to this Act must stop or stipulate conditions that must be fulfilled to ensure that personal health data are processed in accordance with this Act.
Decisions that the Norwegian Data Inspectorate makes pursuant to this provision can be appealed to the Data Protection Tribunal Norway.
The Norwegian Board of Health Supervision must be informed about orders issued by the Norwegian Data Inspectorate.
§ 53. Coercive fines
The Norwegian Board of Health Supervision and the Norwegian Data Inspectorate may impose a coercive fine to accrue for each day, week or month after expiry of the time limit set for compliance with an order pursuant to Section 51 or 52, until the order has been complied with. Coercive fines may also be imposed as a single-payment fine.
The Norwegian Board of Health Supervision and the Norwegian Data Inspectorate may waive an accrued coercive fine. The coercive fine does not start to accrue until the time limit for appeals has expired. If the decision is appealed, the coercive fine does not start to accrue until such time as decided by the appeal body.
Outstanding contributions to cover expenses are enforceable by attachment.
§ 54. Penalties
Anyone who wilfully or through gross negligence violates or is complicit in violation of provisions laid down in this Act or provisions laid down pursuant to this Act shall be liable to fines or imprisonment not exceeding one year or both.
If there are particularly aggravating circumstances, a sentence of imprisonment of up three years may be imposed. When deciding whether particularly aggravating circumstances exist, weight shall be accorded to, among other things, the risk of major injury or inconvenience for the research participant, the anticipated gain of the violation, the duration and scope of the violation, manifest culpability, and whether the person in question has previously been convicted for violation of corresponding provisions.
Chapter 11. Final provisions
§ 55. Entry into force and transitional rules
This Act shall come into force from such time as decided by the King. The King may decide that the individual provisions in the Act shall enter into force at different times.
The King may issue transitional rules in regulations.
§ 56. Amendments to other Acts
1. The following amendments shall be made to the Act of 21 February 2003 no. 12 relating to biobanks (the Biobanks Act):
The name of the Act shall be changed to:
Act of 21 February 2003 no. 12 relating to clinical biobanks (the Clinical Biobanks Act)
Section 1, second paragraph shall read:
This Act shall ensure that material in a biobank can be used for health-related purposes, including diagnosis, treatment and teaching in a way that meets satisfactory ethical standards.
Section 2, second paragraph is repealed. The current third and fourth paragraphs will become the new second and third paragraphs.
Section 2, third paragraph shall read:
The term donor as used in this Act means a person who provides biological material for inclusion in a diagnostic biobank or treatment biobank.
Section 3, third paragraph shall read: Biological material that is taken for the purpose of medical examination, diagnosis and treatment and that is destroyed shortly afterwards does not come within the scope of this Act.
Section 3, new fourth paragraph shall read: This Act does not apply to human biological material and health and personal data derived from human biological material that is being used or is going to be used in research. The collection, storage, processing and destruction of human biological material and data for research purposes are governed by the Health Research Act.
Section 4 is repealed.
Section 5, first paragraph shall read: The Ministry shall be notified of any biobank established for the purpose of diagnosis and treatment. Such notification shall be sent to the Ministry within two months of the establishment of the biobank. The notification shall include information on: 1. the purpose for which the biobank is to be established,
2. the type of material it is to contain and how the material is to be collected,
3. which and how many people material has been or is to be collected from,
4. how consent is to be obtained and what information donors will be given in advance,
5. the length of time for which the biobank is to be maintained and what will be done with the material when it is closed down,
6. the security measures related to operation of the biobank,
7. the person in charge of the biobank pursuant to Section 7 and the data controller or controller pursuant to the Personal Health Data Filing System Act and Personal Data Act, and
8. how the biobank is to be financed and whether any financial gain will be made from the material in the biobank.
Section 5, second paragraph shall read:
The provisions of the Health Research Act apply if material from a biobank established for the purpose of diagnosis and treatment is to be used for research.
Section 10, fourth paragraph is repealed.
Section 12 is repealed.
Section 13, first paragraph shall read: If previously collected material and data are to be put to different, wider or new use that does not fall within the scope of the original consent, new voluntary, express and informed consent shall be obtained, unless otherwise follows from the Act on medical and health research.
Section 13, second, third and fourth paragraphs are repealed.
Section 14, first paragraph shall read: Any person who has given their consent pursuant to Sections 11 and 13 may withdraw such consent at any time.
Section 14, second paragraph, second sentence is repealed. Section 15, first paragraph, first sentence shall read: If the consent of the donor has been obtained in accordance with Sections 11 and 13, others may be granted access to the biological material in a biobank or to specified parts of the material. Section 15, third paragraph is repealed.
Section 15, new last paragraph shall read:
The King may by regulations decide that human biological material can be surrendered to the prosecuting authorities or to a court of law in very exceptional cases justified by extraordinarily compelling private or public interests.
Section 18, first paragraph, first sentence shall read:
The Ministry may issue orders to a biobank or stop its further operation if it is being run in contravention of this Act or if the scope of its activities falls outside what has been notified to the Ministry in accordance with Section 5. 2.
2. The following amendments shall be made to Act of 18 May 2001 no. 24 on personal health data filing systems and the processing of personal health data (the Personal Health Data Filing System Act):
Section 3, new fourth paragraph shall read: This Act does not apply to the processing of personal health data that is regulated by the Health Research Act.
Section 5, first paragraph shall read:
Personal health data may only be processed by automatic means when this is permitted pursuant to Sections 9 and 33 of the Personal Data Act, the Health Research Act or it is so provided by statute and is not prohibited on other special legal grounds. The same applies to other processing of personal health data, if the data are part of or are intended to be part of a personal health data filing system.