A health research platform wants to collect detailed data about users' diagnosed medical conditions and rely on consent under the GDPR to do so. Its lawyer notes that the consent standard for this category of data differs from the consent the platform uses for ordinary newsletter sign-ups. Which condition must the platform satisfy that does not apply to its ordinary newsletter consent?
- AThe consent must be obtained in writing and physically signed, because special category data can only be processed on the basis of a signed paper record.
- BThe consent must be renewed by the data subject every twelve months, because consent to process health data automatically expires after one year.
- CThe consent must be approved by an accredited ethics committee before the platform may rely on it as a lawful basis.
- DThe consent must be explicit, requiring a clear affirmative statement that specifically addresses the processing of the health data. Correct
Why A is wrong: Tempting because a signature feels more robust for sensitive data, but the GDPR does not mandate a handwritten or paper signature; explicit consent can be given electronically, so the writing-and-signature requirement is invented.
Why B is wrong: Tempting because periodic refresh is sometimes good practice, but the GDPR sets no fixed expiry period for consent; whether consent remains valid depends on context, not a hard annual deadline.
Why C is wrong: Tempting because health research is often associated with ethics review, but ethics committee approval is not a GDPR condition for the validity of consent; it may arise under separate research rules, not as a consent requirement under Article 9.
Why D is correct: Correct: Article 9(2)(a) requires explicit consent to process special category data such as health data, which is a higher bar than the unambiguous consent sufficient for ordinary personal data like a newsletter list.