94% of researchers rate our articles as excellent or good
Learn more about the work of our research integrity team to safeguard the quality of each article we publish.
Find out more
Maria Christofidou1*
Theodoros N. Arvanitis2
Dipak Kalra1,3
Nathan Lea3
Mahsa Shabani4,5Pascal Coorevits1- 1Department of Public Health and Primary Care, Faculty of Medicine and Health Sciences, Ghent University, Ghent, Belgium
- 2Department of Electronic, Electrical and Systems Engineering, University of Birmingham, Birmingham, United Kingdom
- 3The European Institute for Innovation through Health Data, Ghent, Belgium
- 4Faculty of Law and Criminology, Ghent University, Ghent, Belgium
- 5Law Centre for Health and Life, Amsterdam Law School, University of Amsterdam, Amsterdam, Netherlands
Introduction: The General Data Protection Regulation (“GDPR”) legal basis for obtaining consent for the processing of personal data for research purposes, where those purposes cannot be fully specified in advance, is provided for in Articles 6, 7 and Recital 33. However, GDPR’s requirements for obtaining consent, as to the secondary use and sharing of data in research, have been argued to have generated confusion, whilst the conflicts between the Regulation itself, its practical application and research ethics are well-documented (1). The requirements for “informed consent”, as defined within the GDPR, have not been well defined in the context of genome research or clinical trials (2), which has in turn led to the implementation and interpretation of the lawful basis to span into different idiosyncratic models. This naturally has fed into the uncertainty of how the legal basis can be applied in practice and calls for an investigation into the requirements for consent to be “informed” in the context of health research. This work aims to provide a scoping review and analysis of relevant publications with ultimate purpose to examine whether the concept of ‘data altruism’, as stipulated within Article 2 (10) of the Data Governance Act (“DGA”), addresses the gaps left behind by the application of the legal basis of ‘consent’, under the GDPR (Art. 6 (1) and 7), in so far as the secondary uses of data for research are concerned. In this light the article, by exploring available solutions found in relevant literature and used in practice in national and European projects, examines how ‘data altruism’ can add any value and work as a cohesive solution that the research community can use.
Objectives: The article, through its research, intends to answer the following questions:
What gaps has the GDPR left when it comes to the interpretation and practical application of “consent” towards the secondary use of health data;
Can the DGA, through the mechanism of ‘data altruism’, address these issues and provide a solution;
What solutions have been used so far in practice to address this issue.
Methodology: To address the above-mentioned questions, the Arskey and O’Malley scoping review methodology and best practice, as outlined in the Joanna Briggs scoping review guidelines, have been applied. The research questions have been identified through an extensive literature review and consultation with subject matter experts. The search was conducted using six search engines and utilising a tailored search strategy, with the application of both MESH and non-MESH based search terms. From the identified relevant publications, 148 abstracts were kept to be read and 60 of those publications were kept as relevant. A PRISMA chart showcases the process in which the publications were reviewed and the process which led to the final papers kept as relevant. The title-abstract and full text screening and charting the data were concluded independently by two reviewers. Discrepancies were then resolved by a third reviewer. Results are summarised in both chart and narrative form below.
Results: The final 60 publications were then split into three subcategories: (i) GDPR critique (23 publications listed); (ii) iterations of consent and data altruism (21 publications listed); and (iii) proposed solutions and current practices (31 publications). Certain of the publications fell into more than one of the above subcategories, given the interdisciplinary element of the subject and theme of each paper. Throughout the research, 5 of the publications discuss the Data Governance Act and data altruism, with 4 of those providing a critique over the text used in the DGA and the concept of ‘data altruism’ in relation to ‘consent’ as defined within the GDPR and the overall legislative framework for the secondary uses of data.
Introduction
When the Belmont Commission (1) articulated the necessary conditions for informed consent (2), they might have thought that would be the final word on what informed consent is. Though it is important to note the distinction between ‘consent’ as a theoretical question, ‘consent’ within the context of ethical standards and ‘consent’ as a legal basis for the processing of personal data and their reuse in research, the complexity of the subject, and ambiguous conclusions it has led to, can arguably be seen as common ground.
Over the past few decades, studies and publications show that the collection of data on the basis of precisely informed consent for a single study greatly reduces, and arguably renders impossible, the utility of the data for any future-facing research. The clinical research field had therefore gravitated towards ad hoc and, at times, poorly evaluated means of various forms of broadening the consent initially obtained for the collection, processing and use of data, to incorporate the possibility of the downstream reuse of that data (2, 3).
The requirement for researchers, biobanks and clinical trial repositories to obtain informed consent from invited participants in medical research or clinical trials, prior to the beginning of the research, is a fundamental principle of medical research set out in the Declaration of Helsinki (4). However, the Declaration, albeit not legally binding, is only one of the many international instruments drafted and contributed to the debate over ‘consent’ within the field of medical research over the past few decades (5). It is noteworthy emphasize that the requirement of informed consent in a clinical trial context must not be confused with consent as a legal ground for processing personal data, as the former is a safeguard, an ethical standard and procedural obligation in order for a participant to join a clinical trial whilst the later constitutes a legal basis and a means of data processing compliance.
In a data-driven medical research context, before the General Data Protection Regulation (“GDPR”) (6) entered into force, literature shows that participation of data subjects in research was perceived as integrating both ‘interventional consent’ as well as ‘informational consent’ to process personal data (7). Following the introduction of the GDPR, ‘consent’ gained a codified definition with a threshold to be met, as defined within Article 7 and Recital 32 of the Regulation in order for the legal mechanism to act as an exemption to the processing of special category data under Articles 6 and 9.
The practical implementation of informed consent within this context and the high threshold that has to be met in order for an entity or researcher to be able to rely on the legal basis (informed consent having to be clear, concise, specific and granular, freely given and revocable) have been long discussed and highlighted as being a ‘demanding standard’ (8) that has resulted in uncertainty and confusion as to its practical application and how this can be achieved given the very nature of research. An example, which is often quoted and highlights this complexity, is the challenges that meeting this threshold can impose towards biobanks, when in practice the collection of data as a means of resource that can be repeatedly used for research constitutes the foundation of their structure (2). Further issues, such as the failure of informed consent to engage with the individuals involved in the chain of data transfers (9) and the fragmented practices and requirements across the implementation of ‘consent’ at European Member State level, make it difficult for research ethics committees to establish consistent standards as well as for cross-border data transfers and European projects to come to a cohesive understanding and adopt common practices (10, 11).
Though, as also explicitly mentioned in guidance received from the European Data Protection Board (‘EDPB’), consent is only one of six legal bases to process personal data, and the most appropriate choice of a legal basis should be made depending on the circumstances (4, 12), the questions over the practical application of consent for data reuse and processing and how this can be achieved within research remained unaddressed by the legislator. In this light, the introduction of the Data Governance Act (‘DGA’) (13) formally introduces a more relaxed interpretation of consent, by arguably making provisions for a broad consent model, through the introduction of ‘data altruism’.
Data altruism, as defined within the Regulation, is understood to equate to the voluntary sharing of data based on the consent of data subjects to process their personal data, or the permission of data holders, whether natural or legal persons, to allow the use of their non-personal data, without seeking or receiving a reward going beyond any costs incurred to make data available and for objectives of general interest (14). Though very clearly not constituting a legal basis for processing, by introducing the concept of “processing for purposes of general interest,” the DGA may seem to also allow in certain circumstances the processing of personal data for not strictly defined research purposes which serve the general interest. As one of these purposes could include medical and scientific research, it can therefore be observed that the concept addresses the ‘restrictive position of the Article 29 Working Party on broad consent’ (4).
It is within this context that various iterations of consent for personal data processing and reuse have been identified, each varying in description, and addressing the different levels of communication between research participants and researchers, as well as the means of obtaining consent (15). The varying opinions expressed by scholars and academics on these iterations, with advantages and disadvantages of each being measured and preferences shared, can arguably contribute to the conclusion that the questions raised over the practical application of consent, when the GDPR was first introduced, have yet to be answered and that a solution from the legislator is still very much needed.
In the discussion part of the paper the authors, drawing from the DGA and using above mentioned issues between the practical implementation of the lawful basis of ‘consent’ and research, observe and argue that ‘data altruism’ is in fact bringing a significant change to the existing legal framework, going beyond far and few of the national approaches, and holds real promise to create an opportunity to implement consent and the research exemption in a harmonised manner through building a EU-level data altruism mechanism and fostering EU wide trust in data sharing.
Methodology
In this scoping review, we summarise findings from research conducted in literature, studies and other forms to address and answer the following:
1. What gaps has the GDPR left when it comes to the interpretation and practical application of consent of data subjects towards the secondary use of health data;
2. Can the DGA, through the concept of ‘data altruism’, address these issues and provide a solution;
3. What solutions have been used so far in practice to address this problem.
This rapid evidence synthesis has allowed for the identification of existing practices, models of ‘consent’, as well as a good understanding of the present landscape in terms of data reuse. Further, the research surrounding this review and findings responds to the challenges raised and faced by researchers in this sphere and has provided the authors with an understanding of the role that data altruism can play in this, particularly in light of the upcoming enactment and implementation of the newest addition to the legal landscape for data reuse, the European Health Data Space (EHDS) which will amplify the need for uniform solutions to the present issue in data reuse consistently across Europe.
In order to identify studies relevant to the subject of this review, we have systematically conducted the following research. The search was conducted through the use of six search engines (PubMed, EMBASE, Google Scholar, Web of Science, SAGE and OVID), using a tailored search strategy and through the use of both Medical Subject Headings (MeSH), terms used for indexing, cataloguing, and searching of biomedical and health-related information, and non-MeSH terms and non-MESH terms, as shown in Table 1.
Table 1
Table 1. List of MESH and non-MESH terms.
Searches were limited to publications from the year 2015 onward in order to capture recent consent-related studies and publications, where the GDPR could act as the main source of legislation for the definition of consent.
The keywords and search queries were run through six search engines and findings were limited to full text publications, which were restricted to those available in English. Results stemming from searches conducted through Google Scholar were limited to the first 15 pages. Websites of EU or international bodies whose work focuses on data sharing and grey literature were also researched [e.g., the European Commission, Committee Reports, Impact Assessments and the Legislative Observatory of the European Parliament, the Towards European Health Data Space (‘TEHDAS’) research project]. No further geographic restrictions were identified.
Results from each database and search engine were imported into Excel and duplicates were removed. The reference lists of included publications or related studies for additional citations were also conducted. Publications related to wellbeing data, IoT data, direct-to-consumer services, social media related, organ donation, posthumous data and consent capacity were excluded from the searches as the themes were out of scope for this paper.
The title-abstract and full text screening and charting the findings were concluded independently by two reviewers and discrepancies were then resolved by a third reviewer. The authors also applied snowball sampling of included studies or related publications for additional eligible materials. The search is presented in Table 2.
Table 2
Table 2. Search strategy.
The conducted searches through the use of combined search terms resulted to 6.780 findings, where 415 duplications were identified. The remaining 6.365 publications underwent title review, with 361 publications kept. Subsequently, the remaining findings underwent abstract review which resulted in 146 of those kept and read in full. By excluding publications which were not open access and whose scope was not in line with the parameters of the present research, 36 papers were left. When combined with the publications which were identified via websites, organisations and snowballing, this ultimately resulted to 36 publications remaining as relevant for the purposes of the publication. Figure 1 showcases the process by which the publications were reviewed and the process of the final papers’ inclusion:
Figure 1
Figure 1. PRISMA chart.
The 60 publications were subsequently split into three subcategories—(i) GDPR and ‘consent’ critique as a legal basis, (ii) models of ‘consent’ and data altruism, and (iii) proposed solutions and current practices. Certain publications were listed as part of more than one of the above subcategories, given the interdisciplinary element of the subject.
Results
GDPR and the legal basis of “consent” critique
23 of these publications fell under the GDPR critique category, with the majority arguing that the threshold that stakeholders and researchers have to meet to be compliant with informed consent under the GDPR has left many questions and has created obstacles in advancing research.
Part of the findings in this research point towards a fatigue caused by the issues surrounding “consent”, which in turn has given rise to an emerging default practice of “consent or anonymise” (16). This is further supported by the term “consent misconception” (17), where academics create a correlation between consent, as the preferred mechanism used in ethics, equating to consent being the ideal legal basis for processing of personal data. This has been observed specifically in instances where the only alternative to obtaining consent, seen as necessary in specific cases for the reuse of data, given the difficulty in meeting the legal threshold required is the anonymisation of the dataset. Though frequent, this is however not always a suitable, or even correct, approach given that it may render some datasets useless (for example images or medical scans) or may not fit the structure of the entity that conducts the research (such as biobanks and research/trial repositories).
Within this context, the provisions of the GDPR have been argued by some scholars to show support towards a broad consent approach (18), which would favour future-looking research, with participants providing consent to the donation of their data for a ‘type’ of research, without knowing the specific studies to be conducted. Most frequently these arguments on the spirit of the GDPR stem from the wording of Recital 33 supporting that it provides means for a “relaxed approach” to the reading of Article 9 (2)(a) in cases where identifying the exact purpose of research is not evident at the time of data collection. However, the Working Party’s ‘Guidelines on consent under Regulation 2016/679’ (19) as well as the EDPB’s position (20) offer a much stricter reading and scrutiny over the application and interpretation of the relevant articles.
Models of consent and data altruism
21 publications from the findings discussed and analysed a type of consent, either via comparison to other practices or by arguing for the use of a specific model. The below list showcases the terminology used for the different models identified. The definitions of these models were included in the deliverables of the TEHDAS project (21):
• Informed consent (also referred to as ‘study-specific consent’)
• Implied consent
• Blanket consent
• Broad consent
• Dynamic consent
• Tiered consent
• Meta consent
• Layered consent
• Targeted consent
• Universal consent
• Partnership model of consent
• Opt-it format
• Opt-out format
From the 13 above-mentioned versions of consent, the majority of literature advocate for the use of dynamic or meta consent, with 15 and 6 references, respectively, for each model, in the alternative to the use of broad consent where limitations on this model pose a serious impediment on practical research. Literature preferences for these models as best informed consent practices are expressed on the basis of the continuous engagement of data subjects in the reuse of their data and the level of control that data subjects have over the preferences of how their data is used and shared. In addition to this, both models have been used in connection to electronic informed consent (22), and the use of interfaces and other electronic systems and e-consent tools that support these forms of consent.
The research highlights an interesting juxtaposition between the use of broad consent. With studies quoting up to 98% if its participants being in favour for the utilisation of broad consent in secondary uses of data (23), the model has been described as an imperfect but adequate option for big data resources (24), administratively difficult to achieve and yet still raising questions over the ethical acceptability of less than study-specific consent (25), whilst also seen as satisfying a high ethical standard whilst enabling patients to widely share their data and raise awareness (26, 27).
Further, dynamic consent has also been frequently presented as a preferred option yet criticised as a potential informational burden that participants are asked to carry, especially if not familiar with the IT elements that are frequently engaged (9). Lastly, another version of consent that has been highly quoted in literature is the ‘meta-consent’ model, argued to respect the autonomy of research participants as well as be feasibly achievable for secondary uses of data (28). This model has been argued by scholars to provide as much control as possible to individuals over their own data, yet it has also been heavily criticised for failing to meet the gold standard of consent given that it does not circumvent the unknowability of potential future uses (29) and that, on balance, the costs and practical problems in providing meta-consent to participants outweigh the positive elements.
In addition to the above, throughout the 21 related findings, 5 of the publications discuss the Data Governance Act and data altruism, with 4 of those providing critique over the text used in the DGA and the concept of ‘data altruism’ in light of the ‘consent’ GDPR legal basis and the overall legislative framework for the secondary uses of data. In spite of the fact that the concept of ‘data altruism’ is by no means novel, as related notions such as those of data donation or data solidarity have been long part of the debate on data reuse and sharing for research purposes (30–32), research shows that there is a clear lack of a common understanding or definition in the wider legal and ethical literature. Terms such as “data solidarity” (33), “data donation” (34), “digital philanthropy,” (35) and even “health-information altruists” (36) were part of the findings during the research stage of this publication, and though all seemingly are used interchangeably and speak to the same essence, data being used and benefiting the public, the notions they are based on are in reality rooted in different interpretations. In addition to the definitions found in literature, practical examples of initiatives that resemble the concept of data altruism can be found in national approaches and systems, with the German Patient Data Protection Act and the French Health Data Hub acting as very similar legislation and mechanisms, respectively (27).
Proposed solutions
Lastly, out of the total, 31 publications discussed and included proposed solutions and best practices, stemming from either research projects or national examples and implementations.
Further to the above findings related to the informed consent practices and models, research results also show that practical solutions currently implemented or proposed by stakeholders and academics can be divided into three categories: (i) endorsement of a practice as the gold standard by the legislator and/or the research community; (ii) creation of task forces and better communication channels between stakeholders and the research community, to benefit and enable from solutions explored in the field of navigating secondary uses of data; and (iii) better engagement of patients and research participants as well as promotion and support of data literacy and means through which the present and proposed solutions in the landscape can benefit them.
Specifically, academics suggest the creation of a GDPR-compliant broad consent standard (37) which, complemented by national, international and EU practices, gives rise to harmonised models of consent forms and safeguards enabling cross-border sharing and transfer. In addition, the creation of ‘participation pacts’, ‘social contracts’ and consortia or tasks forces between researchers and donors (38–40) have been raised as potential solutions for the past decade as an attempt to provide harmonisation over the requirements as well as clarity over the reasonable expectations for secondary health data reuse.
In their pursuit for a solution which would accommodate the research community as a whole, the findings show that researchers have developed a variety of electronic tools and models to facilitate the capture of consent in a way to accommodate as many of the iterations as possible. Though the practical use of eIC (‘electronic informed consent’) is still relatively uncommon (41), it has been documented (16) as having the potential to not only harmonise the utilisation of a single tool at an EU-level but has been supported as means of establishing a clear and constant communication channel between research participants and researchers. To add to this, guidance documents setting out the requirements and limitations to the use of eIC, which is increasing in the last four years, in specific cases have been developed, though these practices are observed to so far be adopted, these vary between institutions (16) and the adoption of a harmonised approach across stakeholders can be challenging when considering the reluctance expressed by some Member States for the use of eIC in clinical trials (42).
Drawn from the findings above, the authors conclude that, regarding the questions which have formulated the research conducted, the gaps left behind in the practical application of ‘consent’ as a legal basis under the Art. 6 and 9 of the GDPR are still very much present and constitute an obstacle that the research community is trying to address in a variety of means, without a clear winning answer endorsed. The Data Governance Act, through the concept of ‘data altruism’, could indicate a solution through which the scientific research exemption and consent as legal basis are applied into practice. However, its application, interplay with the GDPR and a common understanding of the concept in the wider clinical, legal and ethical literature are questions that still remain unanswered. Insofar as the solutions proposed and found in literature, the authors endorse the notion of the proposed preferred models and support the need for a unified approach. A discussion and further analysis of the conclusions drawn by the authors and findings can be found below.
Discussion and legal analysis
As highlighted in the research findings, the obstacles in obtaining consent and meeting the necessary legislative threshold for the secondary uses of personal data have been extensively discussed in literature (19). The actual possibility of “meaningful” and compliant consent being obtained at the data collection stage, with both participant and research having full access to the information and understanding of what consenting implies, and the practical realities of how this looks from a costs and time–pressure perspectives have been highlighted both in publications (43) as well as in discussions taking place between stakeholders (44).
The identification of the 13 consent models which are attributed to one GDPR legal basis, and the respective longstanding debates between scholars on the positive and negative attributes that each carries, echo the fragmentation that exists in the research community’s question which has left unanswered since the first draft of the GDPR text. Though the GDPR has provided legal certainty over data protection aspects, it has yet to resolve or sufficiently pragmatically address the key problem of informed consent. In addition, part of the reasoning as to why these models have yet to be translated into widespread practice is due to the fact that it is difficult to envision how they would play with other national restrictions in addition to the European legislative landscape and other practices used in the field. As a response to these issues, the variety of adapted models of informed consent have been developed and identified to have come on the rise as a ‘shift’ from specific consent and with aim to cover a range of future data uses and level of involvement of data subjects.
Given the uncertainties, both on a legal and ethical front, raised by the wide use of broad consent many publications argue in favour of dynamic consent, as an approach that arguably meets “the gold standard” (45), being consistent with the legal requirements required for participants to opt-in for each new reuse of their data in a study, and promoting the active role of the data subject. However, complications may arise in widely adopting this approach taking into consideration the recently agreed European Commission proposal for a European Health Data Space (EHDS) (46), which will equate to a big part of this landscape having to undergo important changes. In the same light, the scalability of dynamic consent can arguably also be questioned given that in practice, individuals engaged in projects will receive numerous requests requiring a positive/negative response yet somehow having to achieve the informed consent threshold.
Though the EDPB’s clarification (39) that ‘consent’ is not the only legal basis that can be relied on for those engaging in scientific research has been welcomed by stakeholders (47), the authors argue that this by no means provides answers to the questions or obstacles faced around the subject particularly when considering that in practice the broad consent model could enable innovation and future looking research whilst balancing both patients’ rights and level of engagement. Other legal bases such as the processing of data necessary for the public interest or for scientific research (Articles 9 (2)(g) and (j) respectively) have been highlighted as carrying additional practical difficulties when analysed through the lens of cross-border sharing and research. Where data processors have to consider the legal specificities of two or more Member States, additional requirements and diverging rules in national approaches, for example for the use and reuse of genomic data in research, have been described as contributing to barriers and obstacles in a fragmented cross-border legislative tapestry (18). An example of this is the diverging approach taken by Latvia and Germany and Latvia, where the former has implemented national specific legislation governing genomic research whilst the latter does not (48). Interestingly, the European Parliament study conducted in 2023 (49) highlighted some of these issues. However, in spite of the proposed solutions and efforts, no permanent solution has been found or implemented. The authors believe that these additional requirements stem from Article 9(4) GDPR, though providing flexibility to Member States to define their own rules for data sharing and enabling national approaches to be integrated into the regulatory framework following the adoption of the GDPR, do indeed contribute to the difficulties faced by researchers and stakeholders in this field.
In this light, the introduction of the DGA could arguably be a light at the end of the tunnel offered by the legislator in the form of a more relaxed approach to the interpretation and application of consent. Through the introduction of data altruism, the DGA is bringing a significant change to the existing legal framework and holds real promise to create an opportunity to implement the legal basis of consent as well as the research exemption in a harmonised manner through building a EU-level data altruism mechanism and fostering EU wide trust in data sharing. Despite existing legal frameworks found in Member States resembling the concept, data altruism is set apart by having the ability to build an EU-wide data sharing altruism mechanism that holds clear promise toward harmonisation. Whether the interpretation of ‘consent’ leans towards a broad consent or not, broad consent being understood as a model of consent which permits for the collection, processing and reuse of data for research that cannot be specified in detail due to its nature, through the introduction of data altruism the DGA may also enable in certain circumstances the processing of personal data for not strictly defined research purposes which serve the general interest, and ultimately enable future looking research. Whilst very clearly not constituting a legal basis for processing, it can also be observed that data altruism could address the ‘restrictive position of the Article 29 Working Party on broad consent’ and create an opportunity to implement the research exemption at an EU level, as one of these purposes could include medical and scientific research (4).
Related to the foregoing, informed consent forms have long been criticised due to their long, jargon-filled format, argued to be frequently used as mere means of obtaining consent and undermining the original aim of being understood by research participants (50, 51). Yet, through the introduction of the European data altruism consent form, under Article 25 of the Regulation, individuals and entities engaged in data altruism and data sharing will be able to have a tangible point of reference as to the requirements needed for the collection of data across Member States in a uniform format, including the informed consent model endorsed by the EDPB and European Data Protection Supervisor (‘EDPS’), members sitting at the European Data Innovation Board. Though the subject was raised during a meeting of the EDIB in early 2024, with a noteworthy mention that researchers would find appealing the broad consent model to be deployed, no further materials are still expected to be shared (52).
In any event, for the successful use of eIC and eConsent tools to be deployed widely and successfully, the ICT tool developed to support in the capture of consent for whichever model chosen would be required. For this to work, an interactive interface that, contributing to the empowerment of the participant in being in control of their data, would allow them to choose and alter their consent choices in real time whilst simultaneously also conforming to the compliance required in both its design and use. Projects such as IDERHA (53), EnCore, HELEX, REg4ALL (54), using broad and dynamic consent as paradigms, have developed a proposed tool which tailors consent options to adhere to the legal requirements whilst ensuring, through keeping the participants in the flow of data, data sharing is enabled. In conjunction to this, a consent matrix (47) has also been proposed as an efficient method for collecting metadata on conditions surrounding consent which, when compared with best practices in the development of consent forms. The use of an eIC alongside the data altruism consent form, as contained within Article 25(4) DGA, and the model of consent used by the legislator in the particular form could act not just as paradigm but indeed as the way forward to tackling the issues of obtaining and reuse data on the basis of consent. The provisions of the DGA referring to the creation of a rulebook through a delegated act, though indeed not a hard requirement in regards to uniform application (55), could also address and bring to light the objectives that the community wishes to achieve through the creation of societal compacts and participation packs. To contribute to the changes in the present legal framework, through the implementation of the DGA across Member States, monitoring bodies tasked with ensuring compliance to the requirements of the Regulation can ensure harmonisation of the data altruism mechanism is achieved through the application of data altruism alongside national requirements and by uniting the efforts made currently on a national or consortium level and bringing them to an EU-wide stage.
The EHDS aims to enable an efficient exchange of and direct access to different health data across the Union in compliance with data protection regulations, in particular the GDPR (43, 56, 57). The EHDS Regulation, though not adopted or implemented yet (58), has placed strong emphasis on stepping away from the use of ‘consent’ as the legal basis for the secondary use of data and instead (59), through the text of Recital 37, aligns the legal basis with Articles 9(2) (g), (h), (i), and (j) GDPR. It could arguably be implied that through this action, the legislator acknowledges the practical difficulties in the secondary uses of health data and the fact that a concrete solution to the issue is very much still present.
With this in mind it is important to note that the EHDS Act makes space for an opt-out mechanism, allowing patients and citizens to actively object to the secondary use of their data. Though this has been overall welcomed by stakeholders (60), this mechanism is left at Member States’ discretion which arguably would be counterintuitive and go against the harmonisation of the application and interpretation of the overall Proposal. Further, though the EHDS by no means alters the legal status and interpretation of consent, its addition to the data reuse landscape will undeniably augment both the demand as well as the opportunity for the reuse of data. Consequently however, it will also increase and highlight the need to provide solutions to the issues faced through the use of ‘consent’ as a legal basis for secondary data uses in the event where, as part of the EHDS implementation, the particular basis is used by Health Data Access bodies in relation to datasets they made accessible. Within this context, it is therefore paramount to ensure that data altruism is a mechanism that benefits the community in sharing health data and is seen as not an additional legal basis circumventing the existing GDPR requirements but rather as means of obtaining consent with qualifiers such as the minimisation of risk of informational harm, offering ethical protection and enabling researchers to conduct forward looking research whilst empowering individuals by having control over their data.
Strengths and limitations
The present publication, to the best of the authors’ knowledge, serves as the first cohesive and conclusive research of the data altruism mechanism and the interconnections with the lawful basis of consent under the GDPR in health data reuse. However, several limitations could be listed for this type of study, given the topic’s close connection to data reuse and the EHDS’s implementation will likely give rise in many more search results with the implementation of the DGA and inputs from the legislator over time.
The DGA framework and data altruism concept are aimed at a variety of sectors and not exclusively towards health data reuse of clinical research, making by extension the findings and conclusions of the present paper perhaps not directly applicable in another context. In this regard, the searches conducted purposely excluded publications related to wellbeing data, direct to consumer services and products as well as consent capacity of individuals and social media related data protection and data uses.
It is important to further highlight that the consensus identified through the uses of the identified models (dynamic, meta or broad consent) does not equate to unanimity. Further qualitative research is required to identify the operational basis and practical implementation of data altruism and the selected model in the field of secondary uses of health data as applied and viewed by stakeholders, data altruism organisations or health data access bodies. Research in relation to the specific consent model to be chosen and deployed eventually by the EU legislator at the stage of implementation of the DGA would also be useful. In addition to this, an important limitation is the discussion on the EHDS, as the Proposal is yet to be neither adopted nor implemented on an EU or national level.
Conclusion
What is paramount to note is that addressing issues related to secondary uses of data in research cannot be solved by ad hoc efforts, whether that be administrative, legal, or policy changes. Rather multidisciplinary discussions in line with the international character of high-level research need to take place (61), involving stakeholders, patients, researchers and the legislator. In this light, we note that the shortcomings of the abovementioned suggested solutions and benefits of such approaches could be aided to come fruition and maximised when paired with the data altruism framework. Support for digital literacy is vital for solutions to the pending issue to be successful in a wide EU setting in order to promote public trust and ensure the transparent and efficient use of electronic platforms and relevant tools (17), one could argue that through the data altruism framework and the text of Article 20, this could be achievable.
Though at present it is as easy to speculate that data altruism consent is another drop of water in the ocean (62), as easily as it is to argue that the concept is a solution long-waited for, the DGA itself and its application are both still at their infancy. Questions on the interplay between data altruism, the GDPR requirements, and the practical implementation of GDPR’s consent as an overall requirement for participation in clinical trial research remain at best unclear and vague (63). What cannot be disputed is that the DGA and the altruism mechanism carry promise and have already been labelled, in studies and literature, as a significant change in the practical landscape of health data research (26, 64).
The detailed review of existing literature and practices contained in this paper may be used as the basis to expand on this area and identify priority areas for further exploration in a subsequent empirical research. The questions have been drafted on the basis of an initial review of the literature and feedback from subject matter experts. Findings could also be used to develop a research agenda for better addressing of key concerns in the application of data altruism and broad consent for future use, including data subject engagement, transparency, and uniform applicability and benefit sharing.
Author contributions
MC: Writing – original draft, Writing – review & editing. TA: Writing – original draft, Writing – review & editing. DK: Writing – original draft, Writing – review & editing. NL: Writing – original draft, Writing – review & editing. MS: Writing – original draft, Writing – review & editing. PC: Writing – original draft, Writing – review & editing.
Funding
The author(s) declare that no financial support was received for the research, authorship, and/or publication of this article.
Conflict of interest
The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Publisher’s note
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.
Abbreviations
DGA, Data Governance Act; EDPB, European Data Protection Board; EDPS, European Data Protection Supervisor; EHDS, European Health Data Space; EU, European Union; GDPR, General Data Protection Regulation; MESH, Medical Subject Headings.
References
1. United States. National Commission for the protection of human subjects of biomedical and behavioral research. The Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research, report, (1978)
2. Starkbaum, J, and Felt, U. Negotiating the reuse of health-data: research, big data, and the European general data protection regulation. Big Data Soc. (2019) 6 205395171986259:205395171986259. doi: 10.1177/2053951719862594
3. A further example is the Observer’s research of the NHS data breach, Das S., ‘NHS data breach: trusts shared patient details with Facebook without consent’, The Guardian. Published May 27 2023. Accessed July 27 2024. Available at: https://www.theguardian.com/society/2023/may/27/nhs-data-breach-trusts-shared-patient-details-with-facebook-meta-without-consent
4. World Medical Association. World medical association declaration of Helsinki: ethical principles for medical research involving human subjects. JAMA. (2013) 310:2191–4. doi: 10.1001/jama.2013.281053
5. Some examples include World Medical Association’s Declaration of Taipei and the Council of Europe’s Recommendation CM/Rec (2016)6 of the Committee of Ministers to member States on research on biological materials of human origin
6. Regulation (EU) 2016/679 Of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC General Data Protection Regulation. (2016).
7. Gefenas, E, Lekstutiene, J, Lukaseviciene, V, Hartlev, M, Mourby, M, and Cathaoir, KÓ. Controversies between regulations of research ethics and protection of personal data: informed consent at a cross-road. Med Health Care Philos. (2022) 25:23–30. doi: 10.1007/s11019-021-10060-1
8. European Data Protection Board (EDPB). Guidelines 05/2020 on consent under regulation 2016/679. Published May 4 2020. Accessed February 2 2024. Available at: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf
9. Caulfield, T, and Kaye, J. Broad consent in biobanking: reflections on seemingly insurmountable dilemmas. Med Law Int. (2009) 10:85–100. doi: 10.1177/096853320901000201
10. Minacori, R, Refolo, P, Sacchini, D, and Spagnolo, AG. Research ethics committees and clinical research in Italy: where are we going? Eur Rev Med Pharmacol Sci. (2015) 19:481–5.
11. Lysdahl, KB, Oortwijn, W, van der Wilt, GJ, Refolo, P, Sacchini, D, Mozygemba, K, et al. Ethical analysis in HTA of complex health interventions. BMC Med Ethics. (2016) 17:16. doi: 10.1186/s12910-016-0099-z
12. EDPB Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b). European Data Protection Board. Published January 23 2019 (Accessed June 7 2021).
13. Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724
15. Steinsbekk, KS, Kåre Myskja, B, and Solberg, B. Broad consent versus dynamic consent in biobank research: is passive participation an ethical problem? Eur J Hum Genet. (2013) 21:897–902. doi: 10.1038/ejhg.2012.282
16. Sethi, N, and Laurie, GT. Delivering proportionate governance in the era of eHealth: making linkage and privacy work together. Med Law Int. (2013) 13:168–204. doi: 10.1177/0968533213508974
17. Dove, ES, and Chen, J. Should consent for data processing be privileged in health research? A comparative legal analysis. Int Data Priv Law. (2020) 10:117–31. doi: 10.1093/idpl/ipz023
18. Hallinan, D. Broad consent under the GDPR: an optimistic perspective on a bright future. Life Sci Soc Policy. (2020) 16:1. doi: 10.1186/s40504-019-0096-3
20. EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para 28. Adopted on 2 February 2021. Available at: https://www.edpb.europa.eu/our-work-tools/our-documents/other-guidance/edpb-document-response-request-european-commission_en
21. TEHDAS, Deliverable 8.2 ‘Report on lessons learned to be applied and recommendations for data altruism practices in the implementation of construction of national and European health data spaces (including broad consent)’, pgs 11-13, 52-55. TEHDAS. Published September 29 2023. Accessed April 2 2023. Available at: https://tehdas.eu/tehdas1/app/uploads/2023/09/tehdas-recommendations-for-data-altruism-practices.pdf
22. De Sutter, E, Borry, P, Geerts, D, and Huys, I. Personalized and long-term electronic informed consent in clinical research: stakeholder views. BMC Med Ethics. (2021) 22:108. doi: 10.1186/s12910-021-00675-7
23. Richter, G, Borzikowsky, C, Lieb, W, Schreiber, S, Krawczak, M, and Buyx, A. Patient views on research use of clinical data without consent: legal, but also acceptable? Eur J Hum Genet. (2019) 27:841–7. doi: 10.1038/s41431-019-0340-6
24. Hofmann, B. Broadening consent--and diluting ethics? J Med Ethics. (2009) 35:125–9. doi: 10.1136/jme.2008.024851
25. Mostert, M, Bredenoord, AL, Biesaart, MC, and van Delden, JJ. Big data in medical research and EU data protection law: challenges to the consent or anonymise approach. Eur J Hum Genet. (2016) 24:956–60. doi: 10.1038/ejhg.2015.239
26. Patrick Woolley, J. How data are transforming the landscape of biomedical ethics: the need for ELSI metadata on consent. Law Govern Technol Series. (2016) 29:171–97. doi: 10.1007/978-3-319-33525-4_8
27. Mikkelsen, RB, Gjerris, M, Waldemar, G, and Sandøe, P. Broad consent for biobanks is best—provided it is also deep. BMC Med Ethics. (2019) 20:71. doi: 10.1186/s12910-019-0414-6
28. Ploug, T, and Holm, S. Meta consent: a flexible and autonomous way of obtaining informed consent for secondary research. BMJ. (2015) 350:h2146. doi: 10.1136/bmj.h2146
29. Manson, NC. The biobank consent debate: why 'meta-consent' is not the solution? J Med Ethics. (2019) 45:291–4. doi: 10.1136/medethics-2018-105007
30. Ankeny, Rachel A, and Leonelli, Sabina. “Valuing data in postgenomic biology.” Duke University Press EBooks, (2015), 126–149
31. Woods, S, and McCormack, P. Disputing the ethics of research: the challenge from bioethics and patient activism to the interpretation of the declaration of Helsinki in clinical trials. Bioethics. (2013) 27:243–50. doi: 10.1111/j.1467-8519.2011.01945.x
32. Lalova-Spinks, T, Meszaros, J, and Huys, I. The application of data altruism in clinical research through empirical and legal analysis lenses. Front Med (Lausanne). (2023) 10:1141685. doi: 10.3389/fmed.2023.1141685
33. European Commission, Consumers Health, Agriculture and Food Executive AgencyHansen, J., Wilson, P., and Verhoeven, E. (2021). Assessment of the EU member states’ rules on health data in the light of GDPR, EU Publications Office Published 2021. Accessed January 3 2023. Available at: https://data.europa.eu/doi/10.2818/546193
34. Skatova, Anya, Ng, Esther, and Goulding, James. (2014). Data donation: sharing personal data for public good?. In Digital Economy All Hands Meeting 1–3.
35. Taddeo, M. Data philanthropy and the design of the infra ethics for information societies. Philos Trans R Soc A Math Phys Eng Sci. (2016) 374:20160113. doi: 10.1098/rsta.2016.0113
36. Kohane, IS, and Altman, RB. Health-information altruists--a potentially critical resource. N Engl J Med. (2005) 353:2074–7. doi: 10.1056/NEJMsb051220
37. Zenker, S, Strech, D, Ihrig, K, Jahns, R, Müller, G, Schickhardt, C, et al. Data protection-compliant broad consent for secondary use of health care data and human biosamples for (bio) medical research: towards a new German national standard. J Biomed Inform. (2022) 131:104096. doi: 10.1016/j.jbi.2022.104096
38. Sanchini, V, Bonizzi, G, Disalvatore, D, Monturano, M, Pece, S, Viale, G, et al. Research biobanks: a trust-based pact in research biobanks. From theory to practice. Bioethics. (2016) 30:260–71. doi: 10.1111/bioe.12184
39. Vayena, E, and Gasser, U. Strictly biomedical? Sketching the ethics of the big data ecosystem in biomedicine. Ethics Biomed Big Data. (2016) 1:17–39. doi: 10.1007/978-3-319-33525-4_2
40. McKeown, A, Mourby, M, Harrison, P, Walker, S, Sheehan, M, and Singh, I. Ethical issues in consent for the reuse of data in health data platforms. Sci Eng Ethics. (2021) 27:9. doi: 10.1007/s11948-021-00282-0
41. Mitchell, EJ, Ahmed, K, Breeman, S, Cotton, S, Constable, L, Ferry, G, et al. It is unprecedented: trial management during the COVID-19 pandemic and beyond. Trials. (2020) 21:784. doi: 10.1186/s13063-020-04711-6
42. National Institute of Pharmacy and Nutrition (OGYÉI). Information on the continuity of clinical trials under COVID-19 (coronavirus). OGYEI (2020). Accessed June 9 2024. Available at: https://ogyei.gov.hu/information_on_the_continuity_of_clinical_trials_under_covid_19_coronavirus___25032020.
43. Casali, PG. European Society for Medical Oncology (ESMO) Switzerland. Risks of the new EU data protection regulation: an ESMO position paper endorsed by the European oncology community. Ann Oncol. (2014) 25:1458–61. doi: 10.1093/annonc/mdu218
44. Examples of such exchanges and materials include the i-HD health data roundtables, a series of multi-stakeholder discussions aimed at examining the challenges and opportunities of health data and to propose practical approaches and calls to action in order to accelerate health data use and reuse. Digital health society (DHS) and the European Institute for Innovation through health data (i~HD). Proposal for a societal compact for the secondary use of health data. The European Institute for Innovation through Health Data (i~HD) (2023). Accessed July 27 2023. Available at: https://www.i-hd.eu/knowledge-center/publications/health-data-round-tables/
45. Thompson, R, and McNamee, MJ. Consent, ethics and genetic biobanks: the case of the Athlome project. BMC Genomics. (2017) 18:830. doi: 10.1186/s12864-017-4189-1
46. European Commission, Directorate general for health and food safety, EU health data space. Accessed June 9 2024. Available at: https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space_en
47. DIGITAL EUROPE ‘making the most of the GDPR to advance health research. Digital Europe. (2021). Accessed July 23 2022. Available at: https://digitaleurope.org/resources/making-the-most-of-the-gdpr-to-advance-health-research/#_ftn16
48. Molnár-Gábor, F, Sellner, J, Pagil, S, Slokenberga, S, Tzortzatou-Nanopoulou, O, and Nyström, K. Harmonization after the GDPR? Divergences in the rules for genetic and health data sharing in four member states and ways to overcome them by EU measures: insights from Germany, Greece. Latvia Sweden Semin Cancer Biol. (2022) 84:271–83. doi: 10.1016/j.semcancer.2021.12.001
49. European Parliamentary Research Service, Mechanism to resolve legal and administrative obstacles in a cross-border context, European Added Value Assessment Study. European Parliament. Published May (2023). Accessed June 9 2024. Available at: https://www.europarl.europa.eu/RegData/etudes/STUD/2023/740233/EPRS_STU(2023)740233_EN.pdf
50. Colombo, C, Mayrhofer, MT, Kubiak, C, Battaglia, S, Matei, M, Lavitrano, M, et al. The CORBEL matrix on informed consent in clinical studies: a multidisciplinary approach of research infrastructures building enduring life-science services. BMC Med Ethics. (2021) 22:95. doi: 10.1186/s12910-021-00639-x
51. Tam, NT, Huy, NT, le Thoa, TB, Long, NP, Trang, NT, Hirayama, K, et al. Participants’ understanding of informed consent in clinical trials over three decades: systematic review and meta-analysis. Bull World Health Organ. (2015) 93:186–198H. doi: 10.2471/BLT.14.141390
52. European Commission. Second meeting of the European data innovation board 7 February 2024, Register of Commission Expert Groups and Other Similar Entities. (2024). Accessed April 12 2024. Available at: https://ec.europa.eu/transparency/expert-groups-register/screen/expert-groups/consult?lang=en&groupID=3903
53. IDERHA (Integration of Heterogeneous Data and Evidence towards Regulatory and HTA Acceptance) Project funded through the Innovative Health Initiative (IHI), Available at: https://www.iderha.org/
54. Kaye, J, Whitley, EA, Lund, D, Morrison, M, Teare, H, and Melham, K. Dynamic consent: a patient interface for twenty-first century research networks. Eur J Hum Genet. (2015) 23:141–6. doi: 10.1038/ejhg.2014.71
56. European Commission, Communication 19.2.2020, COM (2020) 66 final, a European data strategy, p. 5;
57. Directorate General for Health and Safety, 3.1 European Health Data Space, Presentation 18th eHealth Network, (2020). Available at: https://ec.europa.eu/health/ehealth/events/ev_20201112_en (Meeting Documents/Presentations).
58. Proposal for a Regulation of the European Parliament and of the Council on the European Health Data Space COM/2022/197 final
59. European Commission, Explanatory memorandum to the proposal for a regulation of the European Parliament and of the council on the European health data space COM/2022/197 final (2022)
60. European Patient Forum ‘EPF’s position on establishing an opt-out system for the secondary use of health data’. European Patient Forum. Published October 2023, Accessed June 3 2024. Available at: https://www.eu-patient.eu/globalassets/policy/ehds---opt-out-statment-1.pdf
61. Vlahou, A, Hallinan, D, Apweiler, R, Argiles, A, Beige, J, Benigni, A, et al. Data sharing under the general data protection regulation: time to harmonize law and research ethics? Hypertension. (2021) 77:1029–35. doi: 10.1161/HYPERTENSIONAHA.120.16340
62. Veil, Winfried, ‘Data altruism: How the EU is screwing up a good idea’, Algorithm Watch. (2021). Accessed 2 December 2024. Available at: https://algorithmwatch.org/en/eu-and-data-donations/
63. Chassang, G, and Feriol, L. Data altruism, personal health data and the consent challenge in scientific research. Europ Data Protect Law Rev. (2024) 10:57–68. doi: 10.21552/edpl/2024/1/9
64. Shabani, M. The data governance act and the EU's move towards facilitating data sharing. Mol Syst Biol. (2021) 17:e10229. doi: 10.15252/msb.202110229
Keywords: GDPR, consent, data altruism, data governance act, health data, secondary use of data, data sharing
Citation: Christofidou M, Arvanitis TN, Kalra D, Lea N, Shabani M and Coorevits P (2025) Data altruism and the “consent” question: a study into the “consent” models used under the GDPR and how the data altruism mechanism can act as a potential solution for the research community in the reuse of health data. Front. Med. 11:1489925. doi: 10.3389/fmed.2024.1489925
Edited by:
Mette Due Theilade Thomsen, PIP Adviser, DenmarkReviewed by:
Antonio Oliva, Catholic University of the Sacred Heart, ItalyViviana Giannuzzi, Fondazione per la Ricerca Farmacologica Gianni Benzi Onlus, Italy
Copyright © 2025 Christofidou, Arvanitis, Kalra, Lea, Shabani and Coorevits. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.
*Correspondence: Maria Christofidou, bWFyaWEuY2hyaXN0b2ZpZG91QHVnZW50LmJl