Managing Consent for Research

Overview

GDPR Recital 33 acknowledges that "it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection." It therefore permits a degree of flexibility, allowing data subjects to give consent to "certain areas of scientific research when in keeping with recognised ethical standards for scientific research." This is known as "broad consent" and represents a significant departure from the standard specificity requirement.

Article 89(1) requires that processing for scientific research purposes be subject to appropriate safeguards, including technical and organizational measures to ensure respect for the principle of data minimization, such as pseudonymization.

Broad Consent Under Recital 33

What Broad Consent Allows

• Consent to a defined area of research rather than a specific study
• Consent that accommodates purpose evolution within the research area
• Consent that covers secondary use of data for compatible research

Conditions for Valid Broad Consent