Open consent, biobanking and data protection law: can open consent be ‘informed’ under the forthcoming data protection regulation?

Abstract

This article focuses on whether a certain form of consent used by biobanks – open consent – is compatible with the Proposed Data Protection Regulation. In an open consent procedure, the biobank requests consent once from the data subject for all future research uses of genetic material and data. However, as biobanks process personal data, they must comply with data protection law. Data protection law is currently undergoing reform. The Proposed Data Protection Regulation is the culmination of this reform and, if voted into law, will constitute a new legal framework for biobanking. The Regulation puts strict conditions on consent – in particular relating to information which must be given to the data subject. It seems clear that open consent cannot meet these requirements. 4 categories of information cannot be provided with adequate specificity: purpose, recipient, possible third country transfers, data collected. However, whilst open consent cannot meet the formal requirements laid out by the Regulation, this is not to say that these requirements are substantially undebateable. Two arguments could be put forward suggesting the applicable consent requirements should be rethought. First, from policy documents regarding the drafting process, it seems that the informational requirements in the Regulation are so strict in order to protect the data subject from risks inherent in the use of the consent mechanism in a certain context – exemplified by the online context. There are substantial differences between this context and the biobanking context. Arguably, a consent transaction in the biobanking does not present the same type of risk to the data subject. If the risks are different, then perhaps there are also grounds for a reconsideration of consent requirements? Second, an argument can be made that the legislator drafted the Regulation based on certain assumptions as to the nature of ‘data’. The authors argue that these assumptions are difficult to apply to genetic data and accordingly a different approach to consent might be preferable. Such an approach might be more open consent friendly.

Big Data in medical research and EU data protection law: challenges to the consent or anonymise approach

“…Some indicate that broad consent may not meet the conditions on consent as defined in the Parliament's draft GDPR, regarding the information that must be given to the individual. 37,45 The position of the Council seems to be that broad consent should be possible for medical research. 16 This position is reflected in Recital 25aa of the Council's draft GDPR, which states that 'data subjects can give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research.'…”

Cohort Harmonization and Integrative Analysis From a Biomedical Engineering Perspective

“…For instance, a comprehensive essay centering on issues regarding consent obtaining in biobank studies recognized the need for a defensible, sustainable and conceptually coherent consent policy [61]. Adapting freely given, specific and informed consent along with anonymization mechanisms such that: (i) facilitating the process of dynamic re-consent through the use of Information Technology (IT) providing a transparency level between individuals and their data and, (ii) balancing the need for irreversible anonymization and data linkage and continuing data update, are key issues in the protection of individuals with regard to processing of personal data [60][61][62][63][64][65].…”

Peer Review #3 of "Samples and data accessibility in research biobanks: an explorative survey (v0.1)"

“…At European level, the ongoing discussion on consent needed for medical research has involved most of the biobanks in which broad consent has been used to involve participants. The proposed Data Protection Regulation, if transposed into law, will constitute a challenge for biobanks and the scientific community will have to adapt to the new European regulations (Hallinan & Friedewald, 2015;Lucivero et al, 2015 Manuscript to be reviewed hand, the scientific community might use, when possible, ICTs to ask for an individual, specific consent for every new project involving personal data. On the other hand, lawyers, policy makers and experts might release the need of a specific consent, for research projects where open, blanket or presumed consent has been used appropriately.…”