Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her (Art. 4(11) GDPR). It is one of six legal bases under Art. 6(1) and, in its explicit form, one of the exceptions allowing processing of special category data under Art. 9(2)(a).
Art. 7 sets the conditions: the controller must be able to demonstrate consent; a request must be clearly distinguishable from other matters; consent must be as easy to withdraw as to give; and it is presumed not freely given where there is a clear imbalance of power or where performance of a service is made conditional on consent that is not necessary. Pre-ticked boxes and silence do not qualify (Planet49, C-673/17).
In clinical research, consent to participate in a trial (an ethical and CTR requirement, see informed consent) should not be confused with consent as a data protection legal basis. The EDPB (Opinion 3/2019) considers GDPR consent generally inappropriate for trial data because of the power imbalance and because withdrawal would compromise data integrity; sponsors typically rely on Art. 6(1)(e)/(f) and Art. 9(2)(i)/(j) instead. Consent remains relevant for optional sub-studies, future research and marketing communications.
