The Federal Act on Research involving Human Beings – the Human Research Act – governs an important application case for the disclosure of health-related personal data.

As a basic principle, under the Human Research Act (HRA), research on humans may only be carried out with the informed consent of the involved individuals. Further use and dissemination of health-related personal data from the treatment context to the research context is governed separately by Articles 32 ff. HRA. These articles make distinctions according to the sensitivity of the health data and the form in which these data are to be subsequently used: identifying (in the HRA “uncoded”), pseudonymized (in the HRA “encoded”), or anonymized.

Genetic data and biological material

As the most sensitive of personal data, genetic data and biological material may only be disclosed in an identifying/uncoded form with the explicit consent of the individual involved and only for specific research projects (Art. 32 para. 1 HRA).

If the data have been pseudonymized (encoded) previously, then they may be disclosed generally for research purposes, but likewise only with explicit consent (Art. 32 para. 2 HRA). In this case the key for re-identifying the pseudonymized data will not be disclosed, meaning that the data are thus anonymous for the recipient.

Anonymized genetic data and biological material may be disclosed generally for research purposes provided that the data subjects have not objected to anonymization after being adequately informed (Art. 32 para. 3 HRA). The reason for this right to object is that anonymization means the data subjects will lose the right and even the possibility to be informed of findings from this research, including, for example, incidental findings of importance to them, because with anonymized data there is no longer a way to identify them as individuals concerned.

Non-genetic health-related personal data

Under Art. 33 para. 1 HRA, non-genetic health-related personal data may be disclosed generally for research purposes (and not only for a specific research project) in identifying form with the explicit consent of the data subjects, as these data are deemed not quite as sensitive as genetic data.

In pseudonymized form non-genetic health-related personal data may be used for general research purposes if the data subject has been informed in advance and has not entered any objection to the further use.

Finally, non-genetic health-related personal data in anonymized form may be used without any additional conditions.

The differentiation between genetic health-related data and biological material on the one hand and non-genetic health-related personal data on the other is made by the Human Research Act because it assumes that genetic data and biological material have the potential to cause more extensive infringements of fundamental rights than non-genetic health-related personal data.