Legal Basis

Personal data processing by BIOBank under the GDPR

1.Purpose of data processing

Goals

The processing is aimed at traceability of the bone tissue from harvesting to bone transplant.
It ensures that BIOBank fulfils the regulatory requirements, including the good practice rules required by ANSM for the collection of human tissue for therapeutic use, transplantation and follow-up of transplant patients.

Legal basis

Article 6 (1) of the General Data Protection Regulation – GDPR

2.Data controller and Data Protection Officer

Data controller

The data controller for the above-mentioned data processing is BIOBank, located at 3 rue Georges Charpak – 77127 Lieusaint.

Data Protection Officer

Mr Lionel ADDELISSE is the Data Protection Officer (DPO) for BIOBank. He can be contacted through:
mail at 3 Rue Georges Charpak – 77127 Lieusaint or email: laddelisse@biobank.fr or phone: 01.64.42.00.75

3.Processed data

Categories of processed data and data subjects

• Identifying data and professional contact information for sample collection surgeons, transplant surgeons, local biovigilance correspondents, deposit managers, anyone named in the signed agreements and providers working with BIOBank.
• Identifying and sensitive personal data for bone tissue donors and transplant patients.

Data recipients

Depending on their respective needs, BIOBank’s administrative, commercial, collection and quality services are recipients of all or part of the data.

Data transfers to third parties

No data transfer is carried out except to the medical analysis laboratory receiving blood samples from donors, to the outsourced archiving provider and to the competent authorities in the event of a biovigilance investigation.

Data retention periods

The data is retained for a duration of 30 years from the expiry date of the products.

4.Rights on processed data

Access to data

Data subjects have the right to access and obtain copies of their data, to object to the processing of their data, to request the rectification or erasure. They also have a right to limit data processing.

Exercising his rights

The Data Protection Officer is the interlocutor for any request to exercise his rights to this processing.
The DPO can be contacted electronically or by mail.

Claim to the CNIL (French data protection authority)

It is possible to file a claim with the CNIL in case the personal data protection rights are not respected.