GDPR Brief: what is the difference between research ethics consent and data protection consent?

4 Mar 2019

Informed consent is a powerful ethico-legal requirement in most interventional biomedical research involving human participants. But consent to participate in research is a distinct notion from consent pursuant to the GDPR.

Informed consent is a powerful ethico-legal requirement in most interventional biomedical research involving human participants. But consent to participate in research is a distinct notion from consent pursuant to the GDPR. While consent is the primary basis for interventional research for ethical and medico-legal reasons, data protection law provides more flexibility. Under the GDPR, processing of personal data is lawful only if one has a legitimate basis. The six acceptable lawful bases are stipulated in Article 6, of which consent is but one (Article 6(1)(a)). Article 6 should be read in light of Recital 50, which states that further processing for scientific research purposes should be considered to be a compatible processing operation that requires no further or separate lawful basis. So, while consent is one ground for processing, there are also other justifications. And, indeed, where scientific research is carried out as a secondary purpose, then no further lawful basis is needed.

Researchers should consider relying on a lawful basis other than consent for processing personal data for scientific research for at least two reasons. First, the interpretation of consent and what forms a valid consent and how it is to be recorded differs not only between the fields of data protection and research ethics, but also across countries (e.g. what is “informed”, how “broad” can a broad consent be), potentially disrupting international research collaboration. There would also be a need to include the identity of all parties relying on the consent. Second, the possibility of a withdrawal of consent will complicate the situation where data must be removed from a repository. If consent is used as the lawful basis for processing data and a research participant withdraws consent, the controller will no longer have a lawful basis to process personal data about them, unless the data are also processed for another purpose which justifies retention without consent.

Other, potentially more useful, lawful bases under Article 6 include legitimate interests and tasks carried out in the public interest. A crucial consideration when processing “special categories” of personal data such as genetic data and data concerning health is the condition under Article 9(2)(j) that allows these data to be processed on the grounds of scientific research purposes, based on EU or Member State law. Processing these data on the grounds of scientific research purposes can enable organizations to work around the obligation to secure data subjects’ consent for processing.

• Edward S. Dove, “The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era” (2018) 46 Journal of Law, Medicine & Ethics 1013-1030. Available here.

• European Data Protection Board (EDPB), Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)). Available here.

• Information Governance Alliance, The General Data Protection Regulation: What’s New (2018). Available here.

• Article 29 Working Party, Guidelines on consent under Regulation 2016/679 (WP259 rev.01) (2016). Available here.

Relevant GDPR Provisions

• Article 5 – Principles relating to processing of personal data
• Article 6 – Lawfulness of processing
• Article 7 – Conditions for consent
• Article 9 – Processing of special categories of personal data
• Recital 40 – Lawfulness of data processing
• Recital 42 – Burden of proof and requirements for consent
• Recital 43 – Freely given consent
• Recital 50 – Further processing of personal data
• Recital 52 – Exceptions to the prohibition on processing special categories of personal data

Edward Dove is a Lecturer in Law at the University of Edinburgh. His primary research interests are in the areas of health research regulation, research ethics oversight, health-related data access and sharing, and governance of international research collaboration.

See all previous briefs.

Please note that GDPR Briefs neither constitute nor should be relied upon as legal advice. Briefs represent a consensus position among Forum Members regarding the current understanding of the GDPR and its implications for genomic and health-related research. As such, they are no substitute for legal advice from a licensed practitioner in your jurisdiction.