Consent in biobanking

Table Of Contents

Overview  #

Consent is one of the most important ethical and legal concepts in biobanking. It demonstrates respect for participants’ autonomy by allowing individuals to make an informed decision about whether they wish to contribute their biological samples and associated data for research. 

However, researchers often confuse ethical consent with consent as a lawful basis for processing personal data under the General Data Protection Regulation (GDPR). Although both involve agreement by an individual, they serve different purposes and are governed by different rules. Understanding this distinction is essential when designing and operating a biobank. 

Ethical consent and GDPR consent are not the same  #

One of the most common misconceptions in research is that obtaining informed consent to participate in a study automatically satisfies data protection requirements. This is not necessarily the case. 

Ethical consent relates to participation in research and reflects the ethical principle of respect for persons. GDPR consent, by contrast, is only one of several lawful bases that may permit the processing of personal data. 

A participant may therefore: 

  • provide ethical consent to participate in research; while 
  • the processing of their personal data is based on another lawful basis under Article 6 GDPR together with an Article 9 condition for processing special category data. 

This distinction has been repeatedly recognised by the European Data Protection Board (EDPB) and is reflected in many Member States’ research governance frameworks. 

What is ethical consent?  #

Ethical consent is the process through which an individual voluntarily agrees to participate in research after receiving sufficient information to make an informed decision. 

Ethical consent is grounded in internationally recognised ethical principles, including: 

  • respect for autonomy; 
  • dignity; 
  • voluntariness; 
  • transparency; 
  • respect for persons. 

Obtaining informed consent is generally a requirement of research ethics committees and international ethical guidelines, even where it is not required under data protection law. 

Ethical consent should be viewed as an ongoing communication process rather than a single signature on a consent form. 

Why is ethical consent important?  #

Ethical consent enables participants to: 

  • understand the purpose of the biobank; 
  • understand what samples and data will be collected; 
  • appreciate potential benefits and risks; 
  • understand how samples and data may be used in future research; 
  • decide whether to participate voluntarily; 
  • ask questions; 
  • withdraw, where appropriate. 

Good consent processes contribute to transparency, trust and participant engagement. 

What is GDPR consent?  #

Under the GDPR, consent is one possible lawful basis for processing personal data. 

GDPR consent must be: 

  • freely given; 
  • specific; 
  • informed; 
  • unambiguous; 
  • provided through a clear affirmative action. 

Where special category data, such as health or genetic data, are processed, consent must generally also be explicit if consent is relied upon under Article 9(2)(a). 

Why are the two types of consent different?  #

Ethical consent answers the question: “Does this person agree to participate in the research?” 

GDPR lawful basis answers a different question: “On what legal basis is the participant’s personal data processed?” 

The answer to these questions may be different. 

For example, a university biobank may ask participants to provide informed consent to contribute samples for future health research. However, the university may process the associated personal data under the public interest lawful basis rather than relying upon GDPR consent.

Models of consent used in biobanking  #

Consent in biobanking raises issues that extend beyond the question of whether an individual has signed a consent form. Because biobanks retain biological materials and associated data for potentially decades and enable research that may not yet be foreseeable at the time of collection, consent must be considered together with governance, transparency, privacy, data protection, access procedures and participant engagement. 

Traditional informed consent is normally based on information about a specific research intervention, including its purpose, risks and potential benefits. In biobanking, however, it may be impossible to identify all future research questions, researchers, technologies or uses at the time of collection. 

Biobanks are designed to support future research, often over many years, and for this reason, different consent models have been developed. Each seeks to balance participant autonomy with the practical realities of long-term scientific research. 

No single model is appropriate for every biobank. The most suitable approach depends on the objectives of the biobank, applicable national law, governance arrangements and participant expectations. 

Specific consent  #

Specific consent limits participation to one clearly defined research project. Participants receive information about: 

  • the purpose of the study; 
  • what samples and data will be collected; 
  • who will use them; 
  • how long they will be retained. 

If researchers later wish to use the samples for a different project, participants usually need to be recontacted for additional consent unless another legal or ethical basis permits further use. 

An important element to be provided is the possibility to withdraw consent or request withdrawal of identifiable samples and data, subject to applicable law and the conditions explained at the time of consent. However, withdrawal is not necessarily equivalent to complete erasure of all information already generated. 

For example: 

  • samples may already have been distributed to researchers; 
  • data may have been incorporated into analyses; 
  • scientific results may have been published; 
  • datasets may have been irreversibly anonymised. 

Participants should therefore be informed about the practical limits of withdrawal before consenting. 

The WMA Declaration of Taipei expressly recognises a right to withdraw identifiable data and biological material, while also recognising that where material or data have become non-identifiable, the individual may no longer be able to determine their subsequent use. 

Advantages  #

  • maximises participant control; 
  • clear understanding of intended research; 
  • high level of transparency. 

Limitations  #

  • impractical for long-term biobanks; 
  • repeated recontact may be impossible; 
  • may reduce the scientific value of stored samples. 

Broad consent  #

Broad consent allows participants to consent to a range of future research within defined parameters rather than to one specific study. 

Participants are informed about: 

  • the overall purpose of the biobank; 
  • the types of future research that may be undertaken; 
  • governance arrangements; 
  • access controls; 
  • participant protections. 

Future studies are typically subject to independent ethical and governance review. 

Broad consent is widely used in biobanking and has been recognised in international ethical guidance, including the Declaration of Taipei and CIOMS Guidelines. The GDPR also recognises that, in some areas of scientific research, it may not be possible to identify the purpose of future processing fully at the time of data collection. 

Broad consent must be accompanied by safeguards, such as: 

  • independent ethics review; 
  • transparent access policies; 
  • clear scientific and public-interest criteria; 
  • data protection measures; 
  • traceability of samples and data; 
  • governance committees; 
  • procedures for re-contact; 
  • mechanisms for complaints; 
  • clear rules concerning commercial use; 
  • appropriate arrangements for international transfers. 

The WMA Declaration of Taipei specifically links consent for multiple and indefinite uses to information about the purpose of the biobank, risks, types of material and data collected, access rules, privacy protections, governance, return of results, commercial use, benefit sharing and international transfers. 

Advantages  #

  • supports long-term research; 
  • avoids repeated participant burden; 
  • facilitates valuable secondary use of samples and data. 

Limitations  #

  • participants cannot know every future study; 
  • requires strong governance and transparency; 
  • depends upon continued public trust. 

Tiered consent  #

Tiered consent allows participants to choose between different options regarding future use. For example, participants may choose whether their samples can be used: 

  • only for one disease area; 
  • for all health research; 
  • for international collaborations; 
  • for commercial research; 
  • for genetic studies; 
  • for recontact. 

Participants therefore exercise greater control over future use while allowing flexibility for researchers. 

Advantages  #

  • enhances participant choice; 
  • accommodates different values and preferences; 
  • may improve public trust. 

Limitations  #

  • increases administrative complexity; 
  • requires careful tracking of participant preferences; 
  • may complicate data sharing. 

Dynamic consent  #

Dynamic consent is a digital, participant-centred approach that allows ongoing communication between participants and researchers. Participants may use an online platform to: 

  • review information; 
  • change consent preferences; 
  • receive research updates; 
  • provide consent for new studies; 
  • manage communication preferences. 

Rather than viewing consent as a one-time event, dynamic consent treats it as an ongoing relationship. 

Advantages  #

  • promotes participant engagement; 
  • allows preferences to evolve over time; 
  • improves transparency; 
  • supports recontact. 

Limitations  #

  • requires significant technological infrastructure; 
  • may increase costs; 
  • may not be suitable for all participant groups; 
  • digital exclusion may reduce accessibility. 

Dynamic consent should not be viewed as a legal requirement but rather as one possible governance mechanism. 

Choosing an appropriate consent model  #

When selecting a consent model, biobanks should consider: 

  • the purpose of the biobank; 
  • anticipated future research; 
  • participant expectations; 
  • applicable national legislation; 
  • governance safeguards; 
  • opportunities for participant engagement; 
  • available resources; 
  • technological infrastructure. 

Consent should never be considered in isolation. Appropriate governance, transparency, ethics review, data protection, access controls and participant engagement remain essential regardless of the consent model adopted. 

Other Ethical, Legal and Societal Implications  #

Consent and vulnerable persons  #

Additional safeguards are required when participants cannot provide legally valid consent, including children; adults lacking decision-making capacity; persons in vulnerable social or economic circumstances. 

Where legally authorised representatives provide consent, the person’s own wishes and preferences should nevertheless be respected to the extent possible. 

For children, consideration should also be given to obtaining consent or renewed consent when they reach an appropriate level of maturity or adulthood. 

The Council of Europe Recommendation CM/Rec (2016) 6 specifically addresses biological materials from persons unable to consent and emphasises participation of the person in the authorisation process, respect for objections and efforts to obtain consent once capacity is acquired or regained. 

Consent, family members and genetic information  #

Genomic biobanking creates particular challenges because genetic information is potentially relevant not only to the participant but also to biological relatives. 

Consequently, the ethical interests of relatives may need to be considered even though they have not themselves provided a sample. 

The Council of Europe framework is particularly relevant here: Recommendation CM/Rec(2016)6 requires risks to the individual and, where appropriate, to their family to be considered and minimised, and also addresses risks to individuals belonging to the same group. 

This does not generally create a legal requirement for relatives to provide consent to another person’s participation in a biobank. Rather, it illustrates why genomic research requires careful consideration of familial privacy, confidentiality and potential psychosocial consequences. 

Consent and commercial research  #

Participants should be informed, where relevant, that their samples or data may contribute to commercially funded research; pharmaceutical development, products or services, intellectual property. 

Commercial involvement does not necessarily make research ethically unacceptable. However, lack of transparency concerning commercial use can undermine trust. 

The Declaration of Taipei explicitly identifies commercial use, benefit sharing and intellectual property as matters that may need to be addressed in the consent process. 

Consent and international data and sample sharing  #

Modern biobanks increasingly operate through national and international networks. Samples and data may therefore move between research centers, pharmaceutical companies, etc.  Consent materials should be sufficiently transparent about foreseeable transfers and the governance mechanisms protecting participants. Consent alone does not make international transfer lawful. Other legal requirements may apply. 

Consent, equity and social justice  #

When developing biobanking research, it is important to consider fair benefit sharing; inclusion of under-represented populations; exploitation of vulnerable communities; return of research benefits; community engagement. Therefore, a good biobanking depends not only on individual consent but also on whether the overall research system is fair and trustworthy. 

Legal and Ethical Framework   #

European Union  #

1. General Data Protection Regulation (GDPR):   

      • Consent is one possible legal basis under Article 6(1)(a), but it is not the only one. For special categories of personal data, including health and genetic data, an additional condition under Article 9 is required. Article 7 establishes requirements where processing is based on consent, including the ability to demonstrate consent and the right to withdraw it. 
      • Recital 33 and scientific research: it may not be possible to fully identify the purposes of scientific research at the time of data collection. The Recital therefore permits consent to be given to certain areas of scientific research, provided recognised ethical standards are respected. This provision is an important legal reference when discussing broad or more general forms of research consent.  

      2. EDPB Guidelines 05/2020 on consent under Regulation 2016/679: it is an important interpretative source concerning freely given consent; specific consent; informed consent. 

        Council of Europe  #

        1. Convention on Human Rights and Biomedicine (Oviedo Convention) provides a human-rights framework for biomedical research based on informed consent  
        1. Recommendation CM/Rec(2016)6 on research on biological materials of human origin: it recommends that information provided before consent should cover the envisaged research uses, storage conditions, access and transfer policies, re-contact and feedback, as well as the right to refuse or withdraw consent and any limitations on withdrawal. 

        International Ethical Sources  #

        1. World Medical Association Declaration of Helsinki: it is the principal WMA statement on ethical principles for medical research involving human participants. It requires free and informed consent for research and specifically addresses the collection, processing, storage and foreseeable secondary use of biological material and identifiable or re-identifiable data. 
        1. WMA Declaration of Taipei 2016 on Ethical Considerations regarding Health Databases and Biobanks: it addresses broad consent, withdrawal, governance,  commercial use, it states that consent for multiple and indefinite uses can be valid when participants receive adequate information about the biobank and its governance framework.  
        1. CIOMS International Ethical Guidelines for Health-related Research Involving Humans (2016): see Guideline 11, concerning collection, storage and use of biological materials and related data. CIOMS states that the ethical acceptability of broad consent depends on proper governance. 
        1. OECD Guidelines on Human Biobanks and Genetic Research Databases: useful for large-scale population biobanks and international research infrastructures.  

        External Resources  #

        BBMRI-ERIC Resources   #

        From BBMRI National Nodes  #

        • Germany: from the biobanking Task Force from the Working Party of the German Medical Ethics Committees, template for broad consent in biobank research   

        BBMRI-ERIC Templates  #

        Publications by BBMRI-ERIC ELSI members  #

        Relevant Literature  #

        Consent for biobanking 

        • Beskow LM, Dombeck CB, Thompson CP, Watson-Ormond JK, Weinfurt KP. Informed consent for biobanking: consensus-based guidelines for adequate comprehension. Genet Med. 2015 Mar;17(3):226-33. doi: 10.1038/gim.2014.102. Epub 2014 Aug 21. PMID: 25144889; PMCID: PMC4336635. 
        • Hofmann, B., Solbakk, J.H., Holm, S. (2009). Consent to Biobank Research: One Size Fits All?. In: Solbakk, J., Holm, S., Hofmann, B. (eds) The Ethics of Research Biobanking. Springer, Boston, MA. https://doi.org/10.1007/978-0-387-93872-1_1 

        Consent models 

        • Solberg B, Steinsbekk K. Biobank consent models – are we moving toward increased participant engagement in biobanking?. Journal of Biorepository Science for Applied Medicine. 2015;3(1):23-33 
          https://doi.org/10.2147/BSAM.S64577  
        • Wiertz, S., Boldt, J. Evaluating models of consent in changing health research environments. Med Health Care and Philos 25, 269–280 (2022). https://doi.org/10.1007/s11019-022-10074-3 

        Broad consent  

        • D. Strech, S. Bein, M. Brumhard, W. Eisenmenger, C. Glinicke, T. Herbst, R. Jahns, S. von Kielmansegg, G. Schmidt, J. Taupitz, H.D. Tröger, A template for broad consent in biobank research. Results and explanation of an evidence and consensus-based development process, in European Journal of Medical Genetics, Volume 59, Issues 6–7, 2016, Pages 295-309, ISSN 1769-7212, https://doi.org/10.1016/j.ejmg.2016.04.002 
        • Grady C, Eckstein L, Berkman B, Brock D, Cook-Deegan R, Fullerton SM, Greely H, Hansson MG, Hull S, Kim S, Lo B, Pentz R, Rodriguez L, Weil C, Wilfond BS, Wendler D. Broad Consent for Research With Biological Samples: Workshop Conclusions. Am J Bioeth. 2015;15(9):34-42. Doi: 10.1080/15265161.2015.1062162. PMID: 26305750; PMCID: PMC4791589. 

        Dynamic consent 

        • Steinsbekk KS, Kåre Myskja B, Solberg B. Broad consent versus dynamic consent in biobank research: is passive participation an ethical problem? Eur J Hum Genet. 2013 Sep;21(9):897-902. doi: 10.1038/ejhg.2012.282. Epub 2013 Jan 9. PMID: 23299918; PMCID: PMC3746258. 
        • Teare, H.J.A., Prictor, M. & Kaye, J. Reflections on dynamic consent in biomedical research: the story so far. Eur J Hum Genet 29, 649–656 (2021). https://doi.org/10.1038/s41431-020-00771-z 
        • Budin-Ljøsne, I., Teare, H.J.A., Kaye, J. et al. Dynamic Consent: a potential solution to some of the challenges of modern biomedical research. BMC Med Ethics 18, 4 (2017). https://doi.org/10.1186/s12910-016-0162-9 
        • Kaye J, Whitley EA, Lund D, Morrison M, Teare H, Melham K. Dynamic consent: a patient interface for twenty-first century research networks. Eur J Hum Genet. 2015 Feb;23(2):141-6. doi: 10.1038/ejhg.2014.71. Epub 2014 May 7. PMID: 24801761; PMCID: PMC4130658. 

        Tiered consent 

        • Nembaware V, Johnston K, Diallo AA, Kotze MJ, Matimba A, Moodley K, Tangwa GB, Torrorey-Sawe R, Tiffin N. A framework for tiered informed consent for health genomic research in Africa. Nat Genet. 2019 Nov;51(11):1566-1571. doi: 10.1038/s41588-019-0520-x. PMID: 31659323; PMCID: PMC7258308. 
        • Tiffin N. Tiered informed consent: respecting autonomy, agency and individuality in Africa. BMJ Glob Health. 2018 Dec 17;3(6):e001249. doi: 10.1136/bmjgh-2018-001249. PMID: 30613430; PMCID: PMC6304098. 

        Re-consent 

        consent, ELSI
        Updated on 25 August, 2026