Abstract

Clinical biobanks processing data of participants in the European Union fall under the scope of the General Data Protection Regulation, which among others includes requirements for consent. These requirements are further specified by the Article 29 Working Party —an EU advisory body currently known as the European Data Protection Board. Unfortunately, their guidance is cause for some confusion. While the GDPR allows participants to give broad consent for research when specific research purposes are still unknown, the WP29 guidelines suggest that additional consent for specific uses should be obtained in addition to broad consent when this becomes applicable. This discrepancy elicits the question whether clinical biobanks can fail the requirement of consent if they obtain broad consent, but not a specific consent for each biomedical study. We analysed this discrepancy within the framework of contextual integrity, in order to describe the context-relative informational norms that govern information flows in clinical biobanks. However, our analysis demonstrates that there is no uniform set of norms that can be applied to all clinical biobanks. As such, neither the GDPR nor the WP29 guidance can act as a “one size fits all” approach to all clinical biobanks. Rather, differences between clinical biobanks—especially regarding the scientific aims and patient populations—make the case for context-relative norms that determine the appropriate type of consent.