File research
Retrospective research/research with patient files does not fall within the scope of the WMO, as the research subject is not physically involved in the research. Nor have the data that are to be researched been gathered for the sake of the research. The research subjects do not have to change their behaviour for the sake of the research.
The only legislation that applies to this kind of retrospective research is the legislation regarding the medical treatment contract, also known as the Agreement on Medical Treatment Act (Wet op de geneeskundige behandelingsovereenkomst, WGBO, in Dutch), from the Dutch Civil Code (Burgerlijk Wetboek) (Book 7, title 7, section 5), and in some cases of course the General Data Protection Regulation (GDPR).
In addition, one of the review frameworks for non-WMO research may be applicable (refer to page 12-13 of the Toetsingskader medisch-wetenschappelijk niet-WMO-plichtig onderzoek, in Dutch). And COREON (Committee on Regulation of Health Research) has drawn up the Code of Conduct for Health Research (in Dutch). This is a manual for the responsible handling of (personal) data and human tissue in health research.
Rights of the research subjects
The patient’s rights have been laid down in the regulation concerning the medical treatment agreement. Section 7:457 paragraph 1 of the Dutch Civil Code (Burgerlijk Wetboek) states that the carer ensures that no information on the patient is to be passed on or made accessible to third parties without the patient’s consent. The Code does not make any stipulations on the form of consent, so oral consent is in theory sufficient. Legal consent can only be given if the patient has been adequately informed on the access of his or her data by third parties. The patient must be provided with written information upon his request. Furthermore, the regulation stipulates that the providing of the patient information may not lead to the private life of another person being impaired.
The General Data Protection Regulation (GDPR) also stipulates that the participant must give explicit consent for every activity related to the personal data, including the distribution of data by forwarding them.