1. Introduction

Data portability between biobanks refers to the legal and technical ability to transfer an individual's health information, genomic records, clinical data, and associated research information from one biobank to another in a secure, lawful, and usable format.

A biobank is an institution or organised repository that stores human biological samples—such as blood, tissue, DNA, cells, or other specimens—along with associated health and research information.

Data portability becomes important when a donor wants to change research institutions, participate in a different study, obtain access to their genomic information, or enable another institution to conduct authorised research using their data.

However, the right to transfer personal data does not automatically confer a right to transfer physical biological samples, compel a biobank to accept a donor, or require disclosure of every research result. Each issue is governed by the applicable data-protection law, consent terms, research ethics requirements, and rules governing biological materials.

The Indian Council of Medical Research (ICMR) addresses related issues through its ethical guidelines on biological materials, biobanking and datasets, including consent, custodianship, ethics committee oversight, and material transfer agreements.

India Science and Technology+1

2. Legal nature and scope of portability

Data portability involves several legally distinct activities.

A. Personal data portability

Transferring identifiable or pseudonymised personal information, such as donor-provided medical histories, questionnaire responses and certain genomic records.

B. Biological sample transfer

Transferring physical specimens, extracted DNA, tissues or cell lines. This generally requires separate consideration of consent, institutional authorisation, material transfer agreements and applicable import/export rules.

C. Research-data sharing

Making research datasets, derived genomic findings or linked clinical records available to another institution. This may depend on research permissions, privacy safeguards, data-access committee approval and contractual restrictions.

The distinction is important because a transfer may be permissible for one category but restricted for another. For example, a donor may receive a copy of their own data without having a legal entitlement to obtain the original stored tissue or the entire dataset of a research project.

3. International legal framework

A. European Union: GDPR Article 20

The General Data Protection Regulation (GDPR) provides the clearest express statutory right to data portability.

Article 20 allows a data subject, subject to its conditions, to receive personal data they have provided to a controller in a structured, commonly used and machine-readable format and to transmit those data to another controller. Direct controller-to-controller transmission is required where technically feasible.

The right generally requires that:

Processing is based on consent or a contract.

Processing is carried out by automated means.

The information falls within the scope of data provided by the individual.

Exercise of the right does not adversely affect the rights and freedoms of others.

Application to biobanks: A donor may be able to transfer qualifying donor-provided digital information to another biobank. However, Article 20 does not automatically cover every genomic inference, research conclusion, algorithmic prediction or physical specimen generated or maintained by the original institution.

kankerregister.org+1

A critical distinction is that the GDPR's scientific-research provisions do not create a blanket exemption from data protection, nor do they make all research data portable. Article 89 provides safeguards and permits certain restrictions under applicable law, while Article 20 retains its own eligibility conditions.

B. United States: privacy law and specimen governance

The United States does not have one universal federal statutory right equivalent to GDPR Article 20 for all biobank participants.

Relevant rules may arise from:

HIPAA, where the organisation and information fall within its scope.

The Common Rule for covered federally supported or conducted human-subject research.

State privacy, genetic-information and health-record laws.

Research consent forms, institutional policies and agreements between repositories.

HIPAA's individual access right is distinct from a general right to compel a transfer between biobanks. Likewise, the Common Rule regulates research involving human subjects but does not establish a universal portability right over every stored specimen.

C. India: ICMR guidelines and the DPDP Act

In India, the legal analysis requires separating personal digital data from biological material.

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (2017), particularly its discussion of biological materials, biobanking and datasets, addresses ownership, custodianship, informed consent, secondary use, ethics committee oversight and transfer agreements.

Relevant principles include:

The participant's interests and consent must be considered when samples and associated data are used or transferred.

An appropriate Material Transfer Agreement (MTA) should govern transfers of biological specimens.

Ethics committee review and applicable regulatory approvals must be considered for domestic and international collaborations.

Secondary use must be assessed against the original consent, proposed purpose and applicable ethical and legal requirements.

These guidelines provide an important governance framework, but they should not be confused with an unconditional statutory right to move every sample or dataset between institutions.

India Science and Technology+2

The Digital Personal Data Protection Act, 2023 (DPDP Act) is also relevant to digital personal data. However, it does not expressly establish a general right equivalent to GDPR Article 20. Its rights provisions instead include rights such as access to information about personal data, correction, erasure, grievance redressal and nomination, subject to the Act's terms.

There is also an important commencement issue: the Indian Government's notification of 13 November 2025 provides for phased commencement. As of 4 November 2026, the Act's main processing provisions in sections 3–17 are scheduled to commence 18 months after that notification, in May 2027. Accordingly, those provisions should not be treated as already fully operative.

India Code+1

For a biobank in India, the practical question is therefore not simply whether a donor has a general portability right, but whether the proposed transfer is supported by the applicable law, consent, ethics approvals, institutional policies and any relevant contractual or regulatory permissions.

4. Detailed case laws

Direct reported judgments establishing a general right to data portability specifically between biobanks remain limited. The following cases are relevant by analogy because they address access to personal data, biological-material ownership, informed consent and the permissible use of donated specimens.

Case 1. Österreichische Datenschutzbehörde and CRIF, Case C-487/21 (2023)

Court of Justice of the European Union · Judgment of 4 May 2023

Facts: An individual sought access to personal data processed by a business and requested a copy of the relevant documents and database information.

Legal issue: What does the GDPR's right to receive a copy of personal data require?

Decision: The Court held that the copy must be a faithful and intelligible reproduction of the personal data. Depending on what is necessary to make the data understandable and permit the effective exercise of data protection rights, copies of document extracts or entire documents may be required.

curia+1

Application to biobanks:

A biobank should not assume that a bare summary is sufficient to satisfy a valid access request.

Where context is essential to understand the individual's personal data, relevant records or extracts may need to be provided.

Properly structured exports can help donors understand, verify and transfer qualifying information.

Limitation: This is principally an Article 15 access-right judgment, not a ruling that every biobank must transfer all research data to another biobank under Article 20.

Case 2. Moore v. Regents of the University of California, 51 Cal. 3d 120, 793 P.2d 479 (1990)

Supreme Court of California, United States · 9 July 1990

Facts: John Moore's cells were used in research after their removal during medical treatment. His physicians allegedly failed to disclose their research and commercial interests. A cell line was subsequently developed from his cells.

Legal issue: Did Moore have a conversion claim based on the unauthorised use of his excised cells?

Decision: The court rejected his conversion claim concerning the excised cells, but recognised that claims based on a physician's failure to disclose material personal interests could proceed. The judgment did not establish a universal rule that donors have no rights relating to privacy, consent or information.

Justia Law+1

Application to biobanks:

Physical ownership of a specimen and rights relating to its collection and use are separate legal questions.

A donor cannot necessarily compel the transfer of a specimen simply by asserting ownership.

Institutions should document consent limitations and communicate permitted uses to downstream researchers.

Data portability and specimen portability should be analysed separately.

Legal significance: Moore demonstrates why the right to control a biological sample cannot automatically be inferred from the right to access or transfer personal information.

Case 3. Greenberg v. Miami Children's Hospital Research Institute, Inc., 264 F. Supp. 2d 1064 (S.D. Fla. 2003)

United States District Court, Southern District of Florida

Facts: Families and organisations involved in research into Canavan disease challenged the handling and commercialisation of research associated with donated genetic materials and information.

Legal issue: Whether the contributors could establish ownership-based and related claims arising from the use of donated biological materials and resulting research.

Decision: The court rejected key conversion and unjust-enrichment theories while allowing other claims, including certain allegations concerning informed consent and fiduciary obligations, to be considered. The ruling depended on the claims and circumstances before the court.

Application to biobank portability:

Donating samples or contributing information does not necessarily confer ownership over all subsequent discoveries.

The right to receive or transfer qualifying personal information is distinct from entitlement to research outputs, intellectual property or commercial benefits.

Biobanks should specify permitted secondary uses, sharing arrangements and benefit-sharing commitments in consent documentation and transfer agreements.

Limitation: The case does not decide whether an individual has a statutory data-portability right. Its relevance is to the boundary between donor interests, specimen governance and downstream research rights.

Case 4. Washington University v. Catalona, 490 F.3d 667 (8th Cir. 2007)

United States Court of Appeals for the Eighth Circuit

Facts: A dispute arose over research tissue samples donated by prostate cancer patients and whether the researcher could direct their transfer to another institution.

Legal issue: Whether donors retained ownership interests permitting them to authorise the transfer of the samples independently of the repository institution.

Decision: The Eighth Circuit upheld the conclusion that the donors, under the donation arrangements at issue, did not retain the claimed ownership interests that would allow them to direct the transfer of the samples to another institution.

The Hastings Center for Bioethics

Application to biobanks:

A donor's request to transfer physical samples may depend on the original donation terms and applicable property law.

A repository's custodianship and institutional arrangements may constrain specimen movement.

Personal-data access and portability rights must be considered independently of specimen ownership.

Legal significance: This is a particularly useful case for distinguishing the portability of digital data from the movement of physical biological materials.

Case 5. Roche v. Primus / biobank-specific litigation distinction

For legal research, it is important not to cite general biomedical or patent disputes as though they directly determine biobank portability. The cases discussed above are useful analogies, but none establishes a universal duty to transfer a donor's complete biobank record.

A sound legal argument should identify the precise right being claimed: access to data, transfer of personal data, transfer of a specimen, withdrawal of consent, or disclosure of research findings. The governing legal test differs for each.

Case-law comparison

These are persuasive comparative authorities, not substitutes for the governing legislation in the jurisdiction where the biobank operates.

5. Principal legal issues in transfers between biobanks

A. Informed consent and purpose limitation

A biobank must determine whether the original consent covers the proposed recipient, research purpose and intended data uses.

For example, consent to cancer research does not necessarily authorise unrestricted commercial use, unrelated behavioural research or public release of identifiable genomic records.

Where the original consent is insufficient, the institution should assess whether additional consent, an ethics committee decision or another lawful basis is required.

B. Genetic privacy and re-identification

Genomic information can identify a person indirectly, even when names and addresses are removed. Combining genomic information with family relationships, clinical records or external datasets may create re-identification risks.

Accordingly, transfers should generally use appropriate safeguards, such as:

Pseudonymisation and separation of identifying information.

Encryption in transit and at rest.

Role-based access controls and audit logs.

Restrictions on onward disclosure and re-identification.

Documented incident-response and breach-notification procedures.

Pseudonymised information should not automatically be treated as anonymous.

C. Cross-border transfers

When a biobank transfers information or specimens internationally, it must assess the laws governing both the sending and receiving institutions.

For Indian institutions, the ICMR framework addresses regulatory clearance and material transfer arrangements for biological materials sent abroad. Depending on the project, applicable government approvals and an appropriate MTA or memorandum of understanding may be required.

Government of India+1

For European institutions, GDPR transfer rules may apply to personal data sent outside the European Economic Area, in addition to any national requirements for genetic and health information.

D. Intellectual property and commercial confidentiality

Portability does not automatically transfer:

Patents or ownership of inventions.

Proprietary analytical methods.

Confidential information belonging to other research participants.

Third-party datasets or trade secrets.

Research outputs created by the receiving or original institution.

The biobank should separate the donor's personal information from protected institutional or third-party information and assess whether disclosure restrictions are lawful.

E. Withdrawal of consent and continued research

Moving data to another biobank is not necessarily the same as withdrawing consent from the original biobank.

Where the governing law permits continued processing for particular research purposes, the original institution may retain certain records or continue specified research after a portability request. Conversely, withdrawal may require the institution to stop certain future uses or dispose of specimens, subject to applicable exceptions.

The effect on already-published results, completed analyses and previously distributed datasets requires a separate assessment.

kankerregister.org+1

6. Material Transfer Agreements and Data Transfer Agreements

An MTA governs the transfer and permitted use of physical biological materials. A Data Transfer Agreement (DTA) or Data Access Agreement (DAA) governs the transfer or access of data.

A combined agreement may be appropriate when both samples and associated information are transferred.

International biobank frameworks also use MTAs, DTAs and related agreements to establish conditions for sharing specimens and associated data.

Wiley Online Library+1

7. Recommended legal compliance procedure

1

Identify the requested material

Determine whether the request concerns personal data, genomic analyses, physical samples or all three.

2

Verify the legal basis

Examine the applicable data-protection law, consent documentation, donation terms and relevant research permissions.

3

Obtain institutional approvals

Determine whether ethics committee review, data-access committee approval or government clearance is necessary.

4

Execute appropriate agreements

Use an MTA for specimens and a DTA or DAA for information, as appropriate.

5

Transfer securely and document the process

Validate the data format, recipient identity, access permissions, security controls and audit trail.

6

Manage later requests

Maintain procedures for correction, withdrawal, restriction, onward disclosure and legally required retention.

8. Remedies for unlawful refusal or transfer

The appropriate remedy depends on the jurisdiction and the nature of the dispute.

Unlawful refusal of a data request: A complaint to the relevant data-protection authority or an appropriate judicial remedy may be available.

Unauthorised disclosure: Regulatory complaints, injunctive relief, contractual remedies or compensation may be available where the applicable legal requirements are met.

Unauthorised specimen transfer: The donor or institution may seek enforcement of consent conditions, contractual restrictions or applicable research and regulatory requirements.

Failure to honour an agreed transfer: Contractual remedies may be available if the institution has undertaken a legally enforceable obligation to transfer the relevant material or data.

In India, complaints about ethical issues concerning biobank activities may be raised with the relevant Ethics Committee or Technical Authorization Committee under the applicable ICMR framework. Data-protection remedies must be assessed under the legislation and provisions in force at the relevant time.

ethics.ncdirindia.org+1

9. Conclusion

Data portability between biobanks lies at the intersection of data protection, biomedical research ethics, informed consent, specimen governance and intellectual property.

The central legal principle is that the right to control or receive personal information must be distinguished from ownership or control of physical biological samples and from entitlement to downstream research results.

The GDPR provides an express but conditional portability right. Indian law, as of November 2026, relies on a combination of applicable data-protection provisions, ICMR ethical guidance, consent requirements, transfer agreements and any relevant regulatory approvals; it does not provide a directly equivalent, universal GDPR Article 20 right.

The most defensible approach is to assess each transfer separately, document its legal basis, respect the donor's applicable rights, and establish enforceable safeguards for the recipient institution.

Academic note: This is a comparative legal overview, not a substitute for jurisdiction-specific advice. The cases discussed are relevant analogies; they should not be represented as direct judicial recognition of a universal right to biobank portability.