The Biobank Pivot: Purpose Limitation and Commercial Reuse

Pseudonymisation and the label 'research' do not make the new use compatible.

Article 6(4) requires an assessment of the further purpose, weighing: any link between the original and new purposes; the context of collection and participants' reasonable expectations; the nature of the data; the consequences of further processing; and the existence of safeguards.

Applying those factors:

• Link: both are biomedical, but cardiovascular risk and type 2 diabetes prediction with pharmacy linkage are not the same purpose.
• Expectations: participants were promised cardiovascular research. They would not expect their blood samples to train a model licensed to insurers, and insurance pricing is precisely what many people fear about health data. That is a change in the consequences, not just in topic.
• Nature: Article 9 health data, the most protected category.
• Safeguards: coding with a locally held key is a genuine safeguard, but it protects against re-identification, not against a shift in purpose.

On balance, the commercial insurer-licensing element is incompatible and needs a fresh legal basis. The diabetes research element is closer to compatible, but should be assessed and documented separately rather than bundled with the commercial use.

Consent is purpose-limited, and Article 9 needs a law, not just good intentions.

The existing consent covers research on cardiovascular disease within the context described at collection. It does not reach training a commercial algorithm for licensing to insurers. Recital 33 permits broad consent for research, but only within recognised ethical standards and with specific consent for subsequent phases where that is feasible - which, with 25,000 contactable participants, it largely is.

Article 9 is a separate hurdle that must be satisfied independently of Article 6:

• Article 9(2)(j) scientific research requires a Union or Member State law providing suitable safeguards under Article 89(1). In the Netherlands the implementing act (UAVG) must be checked, as it imposes its own conditions on research use of health data.
• Article 9(2)(a) explicit consent is the cleanest route for the commercial element, obtained specifically and granularly for that purpose.

Article 9(2)(i) public interest in public health is not a route for licensing models to insurers. Getting the Article 6 basis right while ignoring the Article 9 condition is a common and fatal error.

A staged set of conditions, not a single sign-off:

1. A documented Article 6(4) compatibility assessment that separates the academic diabetes work from the commercial licensing.
2. A DPIA under Article 35 - large-scale processing of Article 9 data is expressly listed in Article 35(3)(b) - covering the insurer use case, with the DPO's advice recorded under Article 39(1)(e).
3. Fresh ethics committee approval; the existing approval is limited to cardiovascular research.
4. A clear controller/processor or joint controller structure with the pharmaceutical company (Articles 26/28), including restrictions on onward licensing.
5. Article 89(1) safeguards: pseudonymisation, access controls, no re-identification, restricted data cuts, and a prohibition on using the data to make decisions about individuals.
6. Transparency: specific re-consent or a clear opt-out communication with no detriment where participants are contactable, and Article 14 information where they are not.
7. A DPIA-driven decision on whether insurer licensing is permissible at all. If the answer is no, the element should be excluded from the project rather than mitigated.