Legal Q&A: What is the status of broad consent in Austria?

BBMRI.at Legal Helpdesk Service answers

The BBMRI.at Legal Helpdesk Service – operated by legal experts from BBMRI.at partner UNIVIE- answers questions on legal and regulatory matters around biobanking and/or using biological samples and data. This service is offered to BBMRI.at partners to support them, as biobanking and research using biological samples and data (e.g. human, animal/veterinary, microbial, etc.) may raise legal questions. Answers provided by UNIVIE to legal questions are published in the BBMRI.at Knowledge Base.

QUESTION:

LEGAL Q&A: What is the status of broad consent in Austria?

ANSWER:

1. Consent according to the GDPR

Consent, within the realm of the General Data Protection Regulation (GDPR)^[1], can be defined as “[…] any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (Article 4(11)). Consent is deemed specific when the data subject agrees to a particular data processing operation^[2]. Within the context of scientific research, it is “[…] often not possible to fully identify the purpose of personal data processing” (Recital 33 of the GDPR). To mitigate this circumstance, there is the possibility that consent be given to “[…] certain areas of scientific research”, provided procedures comply with recognised ethical standards for scientific research, for example, an ethical board review^[3]. This form of ‘broad consent’ is allowed as an exception under Recital 33 of the GDPR, i.e., “[…] where purposes for data processing within a scientific research project cannot be specified at the outset, Recital 33 allows as an exception that the purpose may be described at a more general level […]”^[4]. Nevertheless, “[…] it does not disapply the obligations with regard to the requirement of specific consent”^[5].

For biobanks, it is likely that data concerning health – Article 4(15) of the GDPR – will be processed as part of the activities they are involved in. Data concerning health (Article 4 (15)) are a special category of personal data pursuant to Article 9(1) of the GDPR. To process data concerning health, a legal basis under both Articles 6 and 9 of the GDPR must be determined^[6]. In this regard, it is important to point out that in those cases where special categories of data are processed and the legal basis for processing is explicit consent, “[…] applying the flexible approach of Recital 33 will be subject to a stricter interpretation and requires a high degree of scrutiny”^[7].The permissibility of broad consent under the GDPR is beneficial to biobanks, as they are considered to fall under the concept of facilities carrying out scientific research for the purposes of Article 89 of the GDPR^[8].

2. Austrian approach to broad consent

Austria is one of the few EU member states^[9] in which broad consent is specifically addressed in national legislation for archiving purposes in the public interest, for scientific or historical research purposes and for statistical purposes within the meaning of Art. 89 (1) GDPR (§1(3)). In fact, the Austrian Research Organisation Act (Forschungsorganisationsgesetz, or FOG^[10]) establishes, in its §2d(3) that the data subject may consent (in an informed, unambiguous and active manner) to the processing of personal data within a research area, several research areas, research projects or parts of research projects when personal data processing has a legal basis under Article 9(2)(j) of the GDPR.

In the case of the activities performed by biobanks, there is a need to clarify the relationship between § 2d(3) and §2f FOG. In line with the FOG, biobanks, as ‘scientific institutions’(§ 2f(1) FOG) which collect, archive and systematically record research material, may process personal data defined in Article 2f(2) FOG for the purposes of ensuring optimal access to data and research material for purposes pursuant to Article 89 (1) GDPR, i.e. creating and maintaining “repositories”, based on Art. 9(2)(j) GDPR and Article §2f(1) FOG. In other words, for those activities and purposes biobanks do not need broad consent as the legal basis for processing personal data of individuals, but they may do so directly based on rules defined in §2f FOG. Nevertheless, it has to be stressed that this legal basis applies explicitly and exclusively to the activities such as collection, archiving and systematically recording of research material, i.e. “repository activities”. In other words, the purposes for which biobanks do not need to collect broad consent are very clearly defined and limited. Subsequently, researchers, who aim to make use of personal data from biobanks for their (i.e. researchers’) research purposes, which do not correspond with the purposes such as collection, archiving and systematically recording of research material, need to ensure that they obtained broad consent defined in §2(d)(3) FOG for their research purposes, otherwise, based on the currently binding national law, the data could not be used for the purposes of scientific research conducted by the said researcher.