Regulation Of Ultra-Rare Disease Registry Governance Germany

Introduction

Ultra-rare disease registries are specialised databases that collect information about individuals affected by diseases occurring in a very small proportion of the population. They support medical research, diagnosis, treatment development, clinical trials and the evaluation of orphan medicinal products. In Germany, registry governance is not regulated by one single statute. Instead, it is governed through a combination of data protection law, healthcare legislation, research ethics requirements and European Union regulations.

These registries may contain highly sensitive information, including genetic data, medical histories, family relationships and treatment outcomes. Therefore, their governance must balance scientific progress with patient privacy, confidentiality and individual rights.

Legal Framework Governing Disease Registries

The General Data Protection Regulation (GDPR) is the principal legal framework governing personal information collected by ultra-rare disease registries. Article 4(13) classifies genetic data as personal data relating to inherited or acquired genetic characteristics. Article 9 treats genetic and health information as special categories of personal data and generally prohibits processing unless a recognised legal exception applies.

Article 9(2)(j) permits processing of sensitive data for scientific research purposes where it is based on applicable EU or national law and accompanied by appropriate safeguards. Article 89 requires safeguards such as data minimisation, pseudonymisation and technical and organisational protections.

Germany supplements the GDPR through the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). Section 27 BDSG provides conditions for processing special categories of personal data for scientific research and statistical purposes. It requires appropriate safeguards and, where applicable, consideration of whether the research purpose can be achieved without identifying individuals.

The German Social Code Book V (SGB V) also becomes relevant where registry information is obtained from statutory health insurance institutions or healthcare providers. Its provisions concerning health-data processing and research must be considered alongside the GDPR. However, a registry cannot automatically access insurance or hospital records merely because its purpose is scientific research.

Consent and Patient Participation

Informed consent is an important governance mechanism for ultra-rare disease registries. Patients should receive understandable information explaining:

Which medical and genetic information will be collected.

The purpose of the registry and intended research activities.

Who will have access to the information.

Whether data may be shared with researchers or international partners.

How long information will be retained.

Their rights concerning access, correction, withdrawal and objections.

Consent must be voluntary, specific and informed where consent is relied upon as the legal basis. However, GDPR consent is not the only possible legal basis for registry processing. Certain research activities may rely on statutory authorisation under applicable data protection law.

For children and individuals unable to provide legally valid consent, additional safeguards are necessary. Their legal representatives may have a role, but participation must also respect the individual's interests, capacity and applicable rules concerning minors.

Registry Governance and Institutional Responsibilities

German ultra-rare disease registries may be operated by university hospitals, research institutions, patient organisations or specialised medical networks. Their governance arrangements should clearly identify the responsible controller, participating institutions and data recipients.

Institutions should establish:

Independent scientific and ethical review procedures.

Access-control systems for researchers.

Pseudonymisation and secure storage arrangements.

Procedures for reporting and managing data breaches.

Rules governing international data transfers.

Policies for data retention and deletion.

Where processing is likely to create a high risk to individuals, a data protection impact assessment under Article 35 GDPR may be required. International data transfers must comply with GDPR Chapter V.

Germany also participates in European rare-disease cooperation, including European Reference Networks (ERNs). These networks support collaboration between specialised healthcare providers and facilitate knowledge-sharing across borders. Participation does not remove the requirement to comply with applicable data protection and confidentiality rules.

Relevant Case Laws

There is no widely recognised German court judgment specifically establishing a complete legal framework for ultra-rare disease registries. Nevertheless, several important decisions provide principles relevant to their governance.

1. Federal Constitutional Court – Census Act Decision (BVerfGE 65, 1, 1983)

The German Federal Constitutional Court recognised the constitutional right to informational self-determination. Individuals must generally be able to understand and influence how personal information about them is collected and used. This principle is particularly important for rare-disease registries because genetic and medical information may reveal sensitive details about patients and their relatives.

2. Z v Finland, Application No. 22009/93 (1997)

The European Court of Human Rights emphasised the importance of protecting confidential medical information under Article 8 of the European Convention on Human Rights. The judgment supports strict confidentiality safeguards when registries collect or disclose patients' medical records.

3. S. and Marper v United Kingdom, Applications Nos. 30562/04 and 30566/04 (2008)

The Court held that the retention of DNA profiles and related personal information engages privacy rights under Article 8. Although the case concerned forensic databases rather than medical registries, its reasoning is relevant to the retention and protection of genetic information in rare-disease databases.

Conclusion

Germany governs ultra-rare disease registries through the GDPR, BDSG, relevant healthcare legislation and institutional research safeguards. Their lawful operation requires clear processing grounds, strong confidentiality protections, transparent patient information and responsible data-sharing arrangements. Although no single German statute comprehensively regulates these registries, constitutional privacy principles and European case law provide important guidance. Effective governance must ensure that scientific research benefits patients without compromising their fundamental rights.