When drafting the current text for the template PIF, a distinction was made between the decision of the research subject to stop participation in the study on the one hand, and withdrawal of permission for the processing of their personal data on the other. On the one hand, when drafting the current text, the CCMO has taken note of the opinion of WP29 that if consent is the basis for the processing of personal data (which is now deemed to be the correct basis for WMO-related research), based on Article 17, paragraph 1 sub (b) of the GDPR (and there is no other legal ground for the processing), the data must be deleted if the data subject so requests. On the other hand, Article 17, paragraph 3 sub (d) of the GDPR states that paragraphs 1 and 2 are not applicable “to the extent that processing is necessary for[...] scientific research purposes [...] in accordance with Article 89(1) of the GDPR.”
It has been decided to assume that the provisions in Article 17, paragraph 3 sub (d) of the GDPR apply, and the European Commission has at the same time requested clarification. The European Commission has indicated that there are problems with exclusively focusing on consent as the basis for processing personal data for scientific research, while other bases are also conceivable (the legal obligation of the controller or the legitimate interests of the controller) which would also circumvent the sharp edges of the provisions of Article 17, paragraph 1 sub (b) of the GDPR. This has not yet been crystallised fully and until then we consider the current text to be ‘the best possible’ option.