Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Section 4.1  Consent

17. The consent of the data subject, collected pursuant to Article 6 (1) (a) and Article 9 (2) (a) GDPR, may provide a legal basis for the processing of data concerning health in the COVID-19 context.

18. However, it has to be noted that all the conditions for explicit consent, particularly those found in Article 4 (11), Article 6 (1) (a), Article 7 and Article 9 (2) (a) GDPR, must be fulfilled. Notably, consent must be freely given, specific, informed, and unambiguous, and it must be made by way of a statement or “clear affirmative action”.

19. As stated in Recital 43, consent cannot be considered freely given if there is a clear imbalance between the data subject and the controller. It is therefore important that a data subject is not pressured and does not suffer from disadvantages if they decide not to give consent. The EDPB has already addressed consent in the context of clinical trials. Further guidance, particularly on the topic of explicit consent, can be found in the consent guidelines of the former Article 29-Working-Party.

20. Example:  A survey is conducted as part of a non-interventional study on a given population, researching symptoms and the progress of a disease. For the processing of such health data, the researchers may seek the consent of the data subject under the conditions as stipulated in Article 7 GDPR.

21. In the view of the EDPB, the example above is not considered a case of “clear imbalance of power” as mentioned in Recital 43 and the data subject should be able to give the consent to the researchers. In the example, the data subjects are not in a situation of whatsoever dependency with the researchers that could inappropriately influence the exercise of their free will and it is also clear that it will have no adverse consequences if they refuse to give their consent.

22. However, researchers should be aware that if consent is used as the lawful basis for processing, there must be a possibility for individuals to withdraw that consent at any time pursuant to Article 7 (3) GDPR. If consent is withdrawn, all data processing operations that were based on consent remain lawful in accordance with the GDPR, but the controller shall stop the processing actions concerned and if there is no other lawful basis justifying the retention for further processing, the data should be deleted by the controller.