General requirements for consent
For consent to be valid it must be declared expressly and be based on the data subject’s free decision. Consent shall be given in writing unless there are any special circumstances that justify any other form. In the field of scientific research, such special circumstance could be if the purpose of research would be considerably impaired if consent were to be obtained in writing. Both the information provided to the data subject (see below), and the reasons why the research would be seriously affected must then be recorded in writing (cf. Article 4a of the FDPA). When personal data is collected from the data subject, he or she must among others be informed of (cf. 4-3 in the FDPA):
- The identity of the data controller
- The purpose of collection, processing or use
- The categories of potential data recipients, if the data subject could not expect that data will be transferred to these recipients
- The expressly information on categories, in case of which sensitive data is collected
- The right to withdraw consent at any time with future effect
The minimum age limit for a valid consent is not mentioned in German law. In general, consent is valid if the minor is capable to understand the extent and implications of giving consent. This depends of both the scope of the research project, as well as individual capability (Jansen and Hinzpeter 2012).
The law does not distinguish between the different alternatives for lawful processing of personal data, whether they require consent or not. Consequently, it should be sufficient to use alternatives to consent as long as the processing is in accordance with a specific provision (Kühn 2004).
According to the FDPA, collection of special categories of personal data within research is lawful if the following cumulative conditions are met (Section 13.2 no. 8):
· it must be necessary for the purposes of scientific research
· the scientific interest in the research must significantly outweigh the interests of the data subject to rule out the possibility of processing and
· the purpose of the research could not be achieved in any other way or would require a disproportionate effort
· it is also lawful to process special categories of personal data if it has already been made public by the data subject
· In cases of processing personal data based on either of these provisions, notifying the data subject is equally not required if this involves a disproportionate effort.
Kühn, H. 2004. The implementation of the Data Protection Directive 95/46/EC in Germany. In: D. Beyleveld, D. Townend, S. Rouille-Mirza and J. Wright, ed. 2004. Implementation of the Data Protection Directive in Relation to Medical Research in Europe. Ashgate. pp. 121-140.
Jansen, T. og B. Hinzpeter: 2012. Data protection in Germany: overview. [online] Available at: < http://uk.practicallaw.com/3-502-4080#null> [Accessed 31 July 2014].
The Federal Personal Data Protection Act, 2009 [online]. Available at: <http://www.bfdi.bund.de/EN/DataProtectionActs/Artikel/BDSG_idFv01092009..... [Accessed 18. June 2014].