Consent under GDPR
- "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
- Consent may be provided by the data subject in written, electronic or oral format.
- Data controllers must be able to demonstrate that the data subject has consented to processing of his/her data. Therefore, records will need to be kept so that a data subject's consent can be verified.
- Requests for consent must be in intelligible and easily accessible formats, using clear and plain language.
GDPR Article 4(11), Article 7 and Recital 32
Consent is also referred to in GDPR Articles 6(1)(a), 8, 9(2)(a), 13(2)(c), 14(2)(d), 49(1)(a) and Recitals 33, 38, 42, 43, 54, 65, 111, 155, 161, 171
The Article 29 Working Party (Art. 29 WP), an advisory body that provides expert advice to the EU Member States regarding data protection has provided the following guidance on consent:
The Irish Data Protection Commissioner has provided the following guidance note on data protection and health research.
This document contains a section on consent.
It should be noted that this guidance may be updated following the commencement of GDPR, the new Data Protection Act 2018 and the new Health Research Regulations 2018.
The HSE also has a National Consent Policy (2017) which can be found at:
It should be noted that this policy may be updated following the commencement of GDPR, the new Data Protection Act 2018 and the new Health Research Regulations 2018.
In particular, this policy has a section that refers to "research consent waivers". However, a "research consent waiver" is not equivalent to a "consent declaration" under the new Health Research Regulations 2018. Such waivers do not have any legal standing in the context of GDPR and the new Health Research Regulations 2018, nor did it have any legal standing in the context of the previous Data Protection Directive.
This guidance has been prepared by the HRB to help researchers in the health domain comply with GDPR requirements.
It is intended to be general guidance for educational and informational purposes only.
It is not legal advice.