The GDPR acknowledges that if you are collecting personal data for scientific research, you may not be able to fully specify your precise purposes in advance. Thus, in principle, if you are seeking consent to process personal data for scientific research, you do not need to be as specific as for other purposes.
However, GDPR requires that you should identify the general areas of research, and where possible give people granular options to consent only to certain areas of research or parts of research projects.
Broad consent is about giving people consent choices to limit their consent at any stage of the research process.
Thus an individual may limit their consent to:
- the specific and immediate processing planned,
- the next level of research that might be envisaged
- use of their data for a more general research questions/topics within the general area(s) of research that have been specified and that cannot be envisaged right now.
(Note: These granular options for consent are for explanation purposes only. In practice, granular consent options will be specific to the particular research in question).
If it is not possible to fully specify all of the research purposes for which the data may be processed by the person carrying out the research, an individual may give his or her consent to:
- certain areas of health research; or
- only to certain areas of research; or
- parts of a particular research project.
Sufficiently clear information must be provided so that the individual is:
- fully informed; and
- that the consent given is an unambiguous indication of his or her wishes.
Broad consent is not mentioned in the Health Research Regulations 2018.
However, while explicit consent is a mandatory requirement for data processing for health research purposes, the Health Research Regulations 2018 allow for the fact that it may be difficult to fully specify the purposes of the research at the outset.
- Health Research Regulation 3(1)(e) provides that explicit consent from the individual may be obtained "for the purpose of the specified health research, either in relation to a particular area or more generally in that area or a related area of health research, or part thereof".
This allows an individual to give his or her explicit consent where the research area is only generally defined, or is in a related area of health research, and/or to give his or her consent only to certain areas of the specified research areas or to parts of a particular research project.
At all times, the individual must be provided with sufficiently clear information to allow his or her explicit consent to be informed and to represent the unambiguous indication of his or her wishes.
However, in GDPR, the concept of obtaining consent for research purposes where the purposes cannot be fully specificed in advance is provided for in GDPR Article 7 and Recital 33.
This concept is indirectly referred to in the Health Research Regulations 2018 in Regulation 3(1)(e)
This guidance has been prepared by the HRB to help researchers in the health domain comply with GDPR requirements.
It is intended to be general guidance for educational and informational purposes only.
It is not legal advice.