[Implementing the right to withdraw consent to the processing of health data in research projects]

Processing data in health services research requires informed patient consent. When this consent is withdrawn, researchers face the challenge of correctly implementing legal requirements regarding data protection. This article aims to identify and analyze the tasks research institutions must undertake when processing a withdrawal of consent for data processing.

Using a withdrawal case from the RADARplus research project, we conducted a legal analysis of requirements under the General Data Protection Regulation (GDPR) and other relevant legal frameworks. Based on this analysis, we discuss implementation approaches.

The analysis reveals the complexity of implementing a withdrawal of consent procedure: Data may exist in various systems (research databases, backup systems, paper records) and must be identified accordingly. Different retention requirements apply depending on the type of data and legal basis. We outline responsibilities and practical approaches to restricting data processing, such as technical access limitations and blocking notices.

The practical implementation of the right to withdraw consent presents complex challenges for research institutions. Open questions remain, particularly regarding pseudonymized data, long-term data storage, and collaboration with multiple research partners. While the suggested guidance provides a structured approach for legally compliant processing of withdrawals, it does not eliminate the need for data protection assessment and proper documentation.