Whilst consent is a very useful legal basis for scientific research, it can present a challenge for researchers to meet the standards required by the GDPR. Consent, as defined by the GDPR, is required to be a ‘freely given, specific, informed and unambiguous indication’ of the data subject’s wishes regarding the processing of their personal data. When consent is used as a legal basis to process special category data such as health or genetic data, consent is also required to be ‘explicit’.
For many studies, particularly those that are longitudinal or cohort-based, the collection of data began prior to the introduction of the GDPR and the consent form used may not have been designed to meet current requirements. Without a suitable legal basis for processing, it could be impossible to work with the data in the future.
The use of legacy consent may provide a way forward for researchers in certain circumstances. This approach requires the reassessment of the original, pre-GDPR consent to see if it is sufficient to permit new data processing. To help researchers perform an assessment, GHGA has developed the Legacy Consent Toolkit which can be used to guide someone making an assessment.
The GHGA Legacy Consent Toolkit was originally developed by Prof. Dr Fruzsina Molnár-Gábor and her team at Heidelberg University as part of GHGA. A publication regarding the use of legacy consent as a legal basis for processing for research was published in Zeitschrift für Datenschutz, 7/2022, 376-383.
This work has been further developed into an online app available in English. The App can be found at the bottom of this page.
When performing an assessment there are 5 sections to be worked through:
Does the consent align with current GDPR standards?
Is the data still comparable to that described in the original consent?
Is the new processing purpose comparable to that described in the original consent?
Is the person processing permitted to do so under the original consent?
Does the new processing represent a greater risk than the original processing described in the consent?
Legacy Consent Toolkit app users can generate a report based on their assessment with an indication of whether legacy consent might be a suitable legal basis for processing.
Guidance is provided on the right-hand side of the app and as you work through an assessment this information will update to explain what to do for the next step.
The GHGA Legacy Consent Toolkit does not constitute formal legal advice from GHGA members or any institution which is a member of the GHGA Consortium. You should always check with the relevant data protection team or similar responsible persons at your institution before drawing on legacy consent as a legal basis. The report generated by the app should only be used as part of your deliberations regarding the appropriateness of the legal basis, it is not a legal verdict on its applicability by the GHGA consortium.
We are continuing to improve and update the GHGA Legacy Consent Toolkit. If you have suggestions of how we can do so, or features you would like to see added, please get in touch.