New Data Protection Rules in Medical Research

On March 2, 2024, significant changes were made to Article 110 of the Privacy Code regarding the management of health data in medical research. In cases where patient consent cannot be obtained due to complex ethical or organizational situations, it is no longer necessary to send a prior authorization request to the Data Protection Authority.

The Authority acknowledges these changes and requires the adoption of measures to protect the rights of the data subjects, the opinion of the ethics committee, and documentation of the reasons for the inability to obtain consent. Additionally, conducting and publishing a Data Protection Impact Assessment (DPIA) is mandatory. These changes facilitate medical research while ensuring the protection of personal data.