Withdrawal of consent for processing personal data in biomedical research

Abstract

In the context of biomedical research, consent is both a ground for the lawful processing of personal data and a bioethical requirement for participation in scientific research projects. While the conditions for obtaining valid consent are extensively discussed in legal and bioethical literature, withdrawal of consent has received considerably less attention. According to the EU General Data Protection Regulation (GDPR), that data subjects have the right to withdraw their consent at any time, but the duties of the entities processing personal data are not clearly defined in the text of the Regulation. Pursuant to Article 7 GDPR, withdrawal ‘shall not affect the lawfulness of processing based on consent before its withdrawal’, but there is no clear specification of the rules governing what happens after this moment. The assumption underlying this article is that a participant expresses a valid consent for the collection and processing of personal data and, at a certain point during the research life-cycle, decides to withdraw her/his consent. This decision would, prima facie, result in an obligation of the data controller to cease processing the data. However, when more closely examined, there are practical, legal, and ethical reasons for why this might not always be the optimal solution. Stopping the processing after receiving a withdrawal request is not an absolute mandate. Pursuant to the GDPR, consent is one Key Points