Consent to process sensitive personal data must be explicit.
15 The general
restrictions on consent, set out above, will also apply. This suggests a degree of
formality, such as ticking a box containing the express words “I consent”. It is
unlikely explicit consent could be obtained through a course of conduct.
A controller must provide data subjects with a privacy notice setting out how the
individual’s personal data will be processed. The privacy notice must contain the
enhanced transparency information. In Romania, the Laws do not provide any
further details in this respect.
Genetic, biometric, or health-related data processing for the purpose of automated
decision-making or profiling is permitted according to the Law 190/2018 previously
analysed with the explicit consent of the data subject, or if the processing is carried
out under explicit legal provisions, by establishing appropriate measures to protect
the legitimate rights, freedoms and interests of the data subject.
16
This is particularly important because, in the course of the debates regarding this
law, there was a change that limited the processing of the above-mentioned data,
excluding automated decision-making or profiling, even with the express consent of
the data subjects. This would have meant that most medical technology applications
lately would have had to move to another Member State in order to carry out their
activity (such as applications that automatically identify whether a melanoma is
cancerous or not, without the initial intervention of a physician).
What does “health research” mean? “Health research” can be defined as one of
the following types of scientific research for human health purposes:
a) Research aimed at understanding normal and abnormal functioning of the
molecules, cells, organs and organisms;
b) Research that specifically addresses innovative strategies, devices, products or
services for the diagnosis, treatment or prevention of human illness or injury;
c) Research aimed at improving the diagnosis and treatment (including rehabilitation and palliation) of human illnesses and injuries, and at improving the health
and quality of life of individuals;
d) Research aimed at improving the efficiency and effectiveness of healthcare
professionals and the healthcare system;
e) Research aimed at improving the health of the population as a whole or that of
any part of the population through a better understanding of how social, cultural,
environmental, occupational and economic factors determine the state of health.
15 See Handbook on European Data Protection Law, Luxembourg Publications Office of the
European Union, 2017, available at https://cnpd.public.lu/content/dam/cnpd/fr/actualites/interna
tional/2014/07/handbook-european-dp-law/Handbook-dp-law-EN.pdf.
16 Article 3: Processing of genetic data, biometric data or health data
(1) The processing of genetic, biometric or health data for the purpose of automated decisionmaking or profiling is permitted with the explicit consent of the data subject or if the processing is
carried out under explicit legal provisions, with the establishment of appropriate measures to protect
the rights, freedoms and legitimate interests of the data subject.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
297
15 The general
restrictions on consent, set out above, will also apply. This suggests a degree of
formality, such as ticking a box containing the express words “I consent”. It is
unlikely explicit consent could be obtained through a course of conduct.
A controller must provide data subjects with a privacy notice setting out how the
individual’s personal data will be processed. The privacy notice must contain the
enhanced transparency information. In Romania, the Laws do not provide any
further details in this respect.
Genetic, biometric, or health-related data processing for the purpose of automated
decision-making or profiling is permitted according to the Law 190/2018 previously
analysed with the explicit consent of the data subject, or if the processing is carried
out under explicit legal provisions, by establishing appropriate measures to protect
the legitimate rights, freedoms and interests of the data subject.
16
This is particularly important because, in the course of the debates regarding this
law, there was a change that limited the processing of the above-mentioned data,
excluding automated decision-making or profiling, even with the express consent of
the data subjects. This would have meant that most medical technology applications
lately would have had to move to another Member State in order to carry out their
activity (such as applications that automatically identify whether a melanoma is
cancerous or not, without the initial intervention of a physician).
What does “health research” mean? “Health research” can be defined as one of
the following types of scientific research for human health purposes:
a) Research aimed at understanding normal and abnormal functioning of the
molecules, cells, organs and organisms;
b) Research that specifically addresses innovative strategies, devices, products or
services for the diagnosis, treatment or prevention of human illness or injury;
c) Research aimed at improving the diagnosis and treatment (including rehabilitation and palliation) of human illnesses and injuries, and at improving the health
and quality of life of individuals;
d) Research aimed at improving the efficiency and effectiveness of healthcare
professionals and the healthcare system;
e) Research aimed at improving the health of the population as a whole or that of
any part of the population through a better understanding of how social, cultural,
environmental, occupational and economic factors determine the state of health.
15 See Handbook on European Data Protection Law, Luxembourg Publications Office of the
European Union, 2017, available at https://cnpd.public.lu/content/dam/cnpd/fr/actualites/interna
tional/2014/07/handbook-european-dp-law/Handbook-dp-law-EN.pdf.
16 Article 3: Processing of genetic data, biometric data or health data
(1) The processing of genetic, biometric or health data for the purpose of automated decisionmaking or profiling is permitted with the explicit consent of the data subject or if the processing is
carried out under explicit legal provisions, with the establishment of appropriate measures to protect
the rights, freedoms and legitimate interests of the data subject.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
297