The report issued by the SDPA analyzes the impact of the GDPR in the field of biomedical research. Currently any processing of personal data in this context must be based on express consent. However, there are certain exceptions to this general rule, such as the impossibility of identifying the data subjects because their data has been anonymized, or those cases in which the research is related to previous research.
The report confirms that the GDPR and the Spanish Draft Law on the Protection of Personal Data maintain unchanged the rules set forth in the Law on Biomedical Research and the Royal Decree on Clinical Trials. Additionally, they allow for a more flexible interpretation of the scope of consent.
The SDPA points out that, as of the full application of the GDPR, it will not be mandatory for the data subjects to provide their consent for specific research or for the performance of research in a very specific area. Instead, it will be enough for the data subjects to provide their unequivocal and express consent in relation to a wide area of research or to wider fields.
Finally, the report also considers the possibility of carrying out research without consent whenever a set of guarantees is provided, which include, that such research is in the public interest and that it has been authorized by Research Ethics Committees. In this sense, the GDPR also allows for a wider and more flexible interpretation of the aims of the research for which consent must be provided.