The new rules on data protection facilitate biomedical research in Spain

As a general rule, the current legislation establishes that in order to process personal data related to health for purposes of biomedical research it is necessary to have previously obtained the explicit consent of the patient, usually in writing. However, according to Law 14/2007 on Biomedical Research, such consent may not be required in certain circumstances: (i) when the identification of the patient is not possible as his/her data were anonymized; or (ii) when it regards a new research which is related to a previous one.

The Spanish Data Protection Agency (“AEPD”) has recently published a report in which it analyses the impact that the new General Data Protection Regulation (“GDPR”), approved by the European Parliament, and the draft of the Spanish Law on Protection of Personal Data (“LOPD”) –currently being processed– will have in the field of biomedical research.

Such report has been motivated by the concern shown by the scientific community over the fact that these new rules might demand that from now on patients must give their specific consent for each particular research in which they participate.

Flexible interpretation

According to the AEPD, the GDPR and the draft of the LOPD do not only modify the regime contained both in the mentioned Law on Biomedical Research as well as in the Royal Decree 1090/2015 on clinical trials with medicinal products, but they also allow to make a more flexible interpretation of the scope that might be given to the consent granted according to them, going beyond even the more restrictive interpretation of the Law on Biomedical Research.

“Specific and unequivocal” consent

The AEPD considers that when the GDPR becomes applicable, it will not be necessary that individuals give their consent for a specific research; not even in order to carry out research in a very defined branch as, for instance, a specific type of cancer. On the contrary, taking into account the interpretation directly derived from the GDPR, the consent given in relation to a broad branch of research as, for instance, the oncological research or even for broader areas will be sufficiently unequivocal and specific.

Likewise, in the report issued by the AEPD the opportunity is taken to recall the fact that Law 14/2007 foresees the possibility to undertake research without having the patients’ consent, when such research is of general interest and has been authorized by a Research Ethics Committee, provided that certain conditions foreseen in such Law have been met.

From now on it remains to be seen if the doctrine established by the AEPD through this report is followed by the Ethics Committees when authorizing future research.