Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Germany: DSK publishes position paper on secondary use of genetic data in research

On May 15, 2024, the German Data Protection Conference (DSK) published its position paper on the requirements for the secondary use of genetic data for research purposes. The position paper discusses the risks of processing genetic data and the requirements for obtaining consent. The paper also proposes a separate legislation on the secondary use of genetic data for research purposes.

According to the DSK, explicit consent of data subjects must be taken for such processing because genetic data is a special category of data, and only consent under data protection law can provide a legal basis for an individual to exercise their rights and give direct expression to the right to informational self-determination. Additionally, the need for explicit consent arises from the fact that the collection of a genetic sample and genetic examination requires consent according to Article 3(2)(a) of the EU Charter of Fundamental Rights and the Genetic Diagnostics Act. 

What rules are proposed by the DSK?

The DSK states that a separate legislation should differentiate between the various processing purposes of secondary use, such as research and quality assurance. When making this differentiation, it must also be taken into account that Recital 33 of the General Data Protection Regulation (GDPR) only opens up the possibility of broad consent for scientific research and not for quality assurance. Further, the proposed legislation should provide, among other things:

  • effective technical and organizational guarantees like Protection by Design and Default to ensure that after revocation of consent the processing of the genetic data of the data subjects ends and the rights of the data subjects can always be effectively exercised;
  • information and advice for the decision of the persons concerned about how to deal with research results and incidental findings ('the right not to know');
  • a legal basis, which for broad consent is only permissible under strict conditions;
  • legally specified retention periods;
  • specific prohibitions on disclosure and transmission subject to sanctions, particularly to employers or insurance companies, and criminalization of the abusive, improper, and unlawful use of genetic data; 
  • an obligation to carry out a Data Protection Impact Assessment (DPIA); and
  • special protection for unborn children, minors, and persons unable to give consent.

You can read the position paper, only available in German, here.