Broad Consent
For the most up to date advice from the European Data Protection Board on the use of 'broad consent for the processing of personal data for scientific research' - see their
responses to requests for clarification from the European Commission (Feb 2021) - (points 26 -31) (link to EDPB website)
Therein, the EDPB states:
- 'where research purposes cannot be fully specified, a controller should be expected to do more to ensure the essence of the data subject's rights are served, including through as much transparency as possible and through other safeguards'; and
- 'adequate safeguards should be put in place to enhance the transparency of the processing during the research project'
The EDPB advises to allow the data subjects to consent: -
- 'in more general terms'; and
- 'for specific stages of the research that are known from the outset'.
The EDPB further advises: -
- 'to ensure the requirements for specificity of consent are met as best and as soon as reasonably possible'; and that
- 'adequate procedures should be in place that data subjects can use to withdraw or further specify their consent for the use of their health data for scientific research purposes'.
The EDPB states even though Recital 33 GDPR offers some room for flexibility in describing the research purposes: -
- 'Adopted research areas [should be] narrowed down'; and
- 'There [should be] an obvious link to the context in which the personal data are collected, and reasonable expectations of the data subjects [should be] taken into account.
Futher Guidance on the Processing of Personal Data for Scientific Research Purposes is awaited.
In the interim, 'broad consent' for future research should be transparent (high levels of transparency for duration of project); specific (as specific as possible, as soon as possible); with data subjects being kept informed and given a mechanism to withdraw from future research, and to specify, when and once known, which specific stages of the research they consent to being involved in, and to further specify their consent.
'Broad consent' in the context of the February 2021 EDPB document refers, inter alia, to the use of consent as an article 6 legal basis, the use of explicit consent as an Article 9 condition, the use of the ethical requirement for informed consent for participation in the medical research project as an Article 89 safeguard; and (in the Irish context) the use of 'explicit consent' as a mandatory suitable and specific measure under the Irish Health Research Regulations (HRRs) 2018 (as amended 2021). As a result, this EDPB advice in respect of 'broad consent' applies throughout Europe.
In the Republic of Ireland, the HRRs require 'explicit consent...a copy of which is provided to the data subject prior to the commencement of the health research in accordance with international best practice on the conduct of health research (which includes informed consent, transparency and independent ethical oversight) for the processing of his or her personal data for the purpose of specific health research, either in relation to a particular area or more generally in that area or a related area, or part thereof'.
The Irish National Office of Research Ethics Committes published Guidance on Data Protection for Research Purposes for Applicants (to the National RECs) on its website on the 6 September 2021 (link to NREC Office website) This quote from page 5 relates to broad consent.
The Irish Health Services Executive National Office of Research and Development published a National Consent Policy for Research on its website on the 20 December 2022 (link to HSE website). This policy states on page 31: - 'For broad consent to be valid, researchers must ensure that secondary use of personal data or biological material continues to be within the area of research specified in the original consent.'
