GDPR Recital 33 (Broad Consent for Scientific Research)

GDPR Recital 33 is the piece of preambular text in the EU General Data Protection Regulation that addresses a specific practical problem in research: consent under GDPR is normally supposed to be for a defined, specific purpose, but many research programmes — biobanks, longitudinal cohorts, registries — cannot fully describe every future use of collected data at the point of collection. Recital 33 states that it is “often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection,” and that data subjects should therefore be allowed to consent “to certain areas of scientific research when in keeping with recognised ethical standards for scientific research,” with the further option to consent “only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

Why this matters in practice

Most research consent design starts from GDPR’s default standard: consent must be freely given, specific, informed, and unambiguous, tied to a stated purpose (Article 4(11), Article 7). Taken literally, that standard is a poor fit for biobanking and longitudinal cohort research, where the whole value of the resource is that it supports research questions not yet formulated at enrolment — sometimes decades later. Recital 33 is the textual basis research organisations, ethics committees, and data protection officers rely on to design consent that is broader than a single named study, without treating it as unlimited, indefinite consent to anything.

In practice this shapes consent-form drafting for biobanks and cohort studies: rather than naming individual future sub-studies, the consent describes a research area or field (e.g. cardiometabolic disease genetics, child development) at a level a participant can meaningfully understand and agree or decline to be part of, coupled with ongoing ethics oversight of each downstream use and a functioning withdrawal mechanism. This is sometimes referred to informally as “broad consent” in the EU context, though see the note below on why that label needs care.

Recital, not Article: what that distinction means

GDPR’s substantive obligations sit in its 99 numbered Articles. The 173 Recitals that precede them are explanatory preamble — the European Parliament and Council’s stated reasoning for how the Articles should be interpreted — and under EU legislative drafting convention they do not themselves create independently enforceable duties. Recital 33 does not, by itself, establish a lawful basis for processing; it explains how the Article 6(1)(a) consent basis (or, for special category data such as health and genetic information, Article 9(2)(a) explicit consent, or the Article 9(2)(j) research derogation as implemented in member-state law) should be read when the processing is scientific research. A data protection authority or court interpreting a consent dispute will look to Recital 33 as guidance on legislative intent, but the operative legal test still runs through the Articles and, for special category health/genetic data specifically, through Article 89(1)’s requirement for appropriate safeguards (data minimisation, pseudonymisation) alongside whatever national research-specific provisions a member state has adopted.

Member-state divergence

Because GDPR is a regulation (directly applicable EU-wide) but leaves research-specific derogations to national implementing law under Articles 9(2)(j) and 89, and because Recital 33 itself is interpretive rather than binding, how strictly “broad consent” is applied in practice varies by member state and by national data protection authority or research-ethics guidance. Some jurisdictions and ethics bodies read Recital 33 relatively permissively for well-governed biobank/cohort research with strong ethics oversight; others expect research consent to stay closer to describing specific, identifiable research purposes and treat area-level consent as acceptable only within narrower bounds. Research organisations operating across multiple EU member states, or handling data subject to more than one national implementing law, should not assume a consent design accepted by one national authority or ethics committee will automatically be accepted by another, and should check current national guidance (e.g. from the relevant national data protection authority or the European Data Protection Board) rather than relying on Recital 33’s text alone.

Recital 33 vs. “broad consent” under the US Common Rule

The term “broad consent” is also used as a specific, defined regulatory mechanism under the US Common Rule at 45 CFR §46.116(d), which lists required disclosure elements and lets an IRB waive consent for individual secondary studies once broad consent has been obtained. That is a different legal system with its own defined criteria — see CASRAI’s Broad consent entry and the Blanket Consent vs. Broad Consent comparison. GDPR Recital 33 is not that mechanism; it is EU interpretive guidance on how the ordinary GDPR consent standard applies to research where the purpose can’t be fully specified up front, without the same itemised regulatory checklist. Organisations running cross-border studies involving both EU and US sites should treat these as related but legally distinct requirements, not interchangeable labels.

Related CASRAI content

• GDPR (General Data Protection Regulation)
• Informed consent
• Dynamic consent
• Withdrawal of consent
• Special Category Data (GDPR Article 9)
• Data Protection Impact Assessment (DPIA)
• GDPR and Data Protection Compliance in Research Involving Personal Data
• Broad consent (US Common Rule)
• Blanket Consent vs. Broad Consent

References

• Regulation (EU) 2016/679 (GDPR), Recital 33
• GDPR Article 6(1)(a) (consent as lawful basis); Article 9(2)(a) and 9(2)(j) (special category data); Article 89(1) (research safeguards)
• European Data Protection Board guidance on consent under Regulation 2016/679