About us
Learn how GA4GH helps expand responsible genomic data use to benefit human health.
GA4GH Policy Brief: children’s data protection and genomic research (part 2: consent and lawful bases)
4 Feb 2025
Following discussion of general considerations related to protection of children’s genomic and health data, part two of this two-part Policy Brief further explores considerations with respect to consent and lawful bases under the General Data Protection Regulation (GDPR). This two-part Policy Brief is published as part of the GA4GH Health Data Sharing, Privacy, and Regulatory Forum’s work to explore laws and regulations that have an impact on genomic and related health data sharing.
By Michael J. S. Beauvais
As detailed in part one of this two-part policy brief, processing children’s data requires special care. This brief addresses some child-specific considerations with respect to consent and lawful basis. It is useful to remember that processing any personal data requires a lawful basis and processing any health or genetic data (“special-category data”) requires an additional justification (“a derogation”).
Consent
Data protection consent and consent in research ethics are distinct. A research team may obtain consent for research ethics purposes while relying on a non-consent-based lawful basis and justification for data processing. While the GDPR has children’s consent provisions, these only apply in the context of “information society services” such as social networking platforms. Thus, a child may be able to consent to data processing by a social networking company, but not in other contexts such as health-related research.
The general rules of GDPR consent apply to children participating in health-related research. Consent must be freely given, specific, informed, and unambiguous. A main concern will be the evaluation of whether the child sufficiently understands the decision to consent such that the consent is informed.
While notions such as “mature minors” — children who demonstrate sufficiently developed rational capacities for a specific decision — exist in clinical and research decision-making, their transposition into research and data protection norms are still not clear. Indeed, capacity to consent to data processing is a poorly understood subject, especially in big-data contexts because understanding the relevant information for data processing is difficult even for informed adults.
If the child does not understand the choice to consent to data processing, either another legal basis should be considered or the consent should be sought from the parent or legally authorised representative. Certain jurisdictions may also have general rules regarding when children can exercise legal rights and powers, e.g. threshold ages. For example, Spain’s national implementation of the GDPR specifies that minors must be at least 14 years of age to consent to data processing.
And even with a parental or legally authorised representative (e.g. guardian or tutor) consent, the additional protections related to children’s data processing will continue to apply. That is, parental permission does not justify treating the child as an adult.
Where consent is relied upon as either a legal basis or derogation for data processing, and a child’s parent or other legally authorised representative has provided the consent, special care must be given to when the child reaches the legal age of majority. The now-adult child has the option to revoke the consent that their parent or legally authorised representative had given. Research teams should consider what sort of notice is required to give to the now-adult participant. Without a rule specifying otherwise, a “fresh” or “new” consent is likely not required to continue to process data (provided that all other requirements are met).
Other options
Research teams may want to investigate alternative legal bases to process the personal data of children. Relying, for example, on the public interest lawful basis (art. 6(1)(e)) and associated derogation for special-category data (art. 9(2)(j)) may obviate the need to notify the now-adult participant as a matter of data protection law, but research regulations may nevertheless require it. Certain jurisdictions may also have notions of “medical contracts” for minors, which would work in tandem with the GDPR’s contractual lawful bases (art. 6(1)(b) and art. 9(2)(h)). Although such medical contracts are typically featured in clinical care rather than research.
As with any research with human participants, discharging one’s obligations under data protection law does not necessarily mean that one is also discharging one’s obligations arising from the conduct of research (i.e. research ethics). Thus, even where consent is not relied upon, involving children in the recruitment process gives effect to their “right to be heard”. Indeed, involving children is part of proper research design and conduct.
Further reading
Information Commissioner’s Office (UK) – Children and the GDPR (2018)
Relevant provisions
Convention on the Rights of the Child
GDPR: recital 38; articles 6, 7, 8, 9
Michael J. S. Beauvais is a doctoral candidate at the University of Toronto’s Faculty of Law.
Related Work Streams
