Consent to participate in research and consent to access and process sensitive healthcare data are two different but overlapping types of consent, each governed by distinct legal and ethical principles. In the context of Real-World Evidence (RWE) studies:

[1] Consent to Participate in Research: This is the informed consent given by individuals to participate in a research study. Informed consent is a process by which researchers provide potential and enrolled participants with information about the study (purpose, procedures, risks, benefits, alternatives), and the participants voluntarily agree to participate. This consent can be withdrawn at any time, at which point the individual’s participation in the study would end.

[2] Consent to Access and Process Sensitive Healthcare Data: This relates to the consent given by individuals to have their personal and sensitive health data accessed and used for specific purposes, such as research. This type of consent is governed in Europe by the General Data Protection Regulation (GDPR). Under the GDPR, the use of health data is considered a processing of special category data and requires explicit consent, which must be freely given, specific, informed, and unambiguous.

In a RWE study, both types of consent may be (are) needed. The first ensures that participants agree to be part of the study and understand what will happen during the study. The second ensures that participants agree to their data being used in the manner specified, and it provides protections around how their data can be stored, transferred, and otherwise processed.

One key difference between these two types of consent is that withdrawal of consent to participate in the research study generally means the individual will not be part of the study going forward, but it does not necessarily mean that the data collected up to that point cannot be used. In contrast, under the GDPR, if an individual withdraws their consent to data processing, not only does the data processing have to stop, but in many cases, the data collected up to that point cannot be used further and may need to be deleted.

Another difference is that, while there are legal and ethical requirements to obtain informed consent for research participation in most cases, there are certain circumstances under which health data can be processed for research purposes under the GDPR without obtaining explicit consent, such as if the processing is necessary for reasons of public interest in the area of public health, or if the data has been anonymized.

In both cases, the principles of transparency, respect for persons, and their autonomy are paramount. Proper management of both types of consent is crucial for ethical research and for maintaining trust with study participants.