Abstract
The right to withdraw consent from research is a well-established right of research participants. This paper examines what it means to withdraw consent from biobank research in the European Union (EU) and the European Economic Area (EEA) – where biobank data is regulated by the General Data Protection Regulation (GDPR) – and how the implications of consent withdrawal are communicated to potential sample donors. An analysis of two biobank consent documents, one from Finland and one from Germany, indicates that donors are informed of the right to withdraw but receive potentially misleading information about its consequences. In particular, the documents do not clarify that withdrawal may not prevent further use of data, overstating the right’s practical effect. This communicative strategy risks undermining informed consent and may erode trust in biobanks as research institutions if sample donors come to feel that they have been deceived. To address this issue, it is recommended that biobanks provide clear and accurate information about the legal impact of consent withdrawal on associated data.
Introduction
The right to withdraw consent from research is a well-established right of research participants. In the context of biobank research, sample donors may withdraw consent for diverse reasons. Broekstra et al. (2022) report that perceived motives range from concerns about societal harms, such as commercialisation of research or limited contributions to healthcare, to personal factors, including negative experiences, time burdens, or changing views on research aims.
Holm (2011) observes that ethics guidelines typically present this right as absolute, unconditional, immediate, complete, and inalienable. He argues, however, that in the biobank context, these features may be reconsidered without significant ethical cost. Specifically, withdrawal need not take immediate and complete effect on the future use of samples and data, and under certain conditions, sample donors might be permitted to consent to non-withdrawability.
Consistent with Holm’s conclusion, the right to withdraw from biobank research is not absolute but regulated by the legal framework of the European Union (EU) and European Economic Area (EEA). Donors retain this right, yet its scope is limited by the General Data Protection Regulation (GDPR) (European Parliament and Council of the European Union, 2016) and relevant national provisions. Because research data that qualify as personal data are governed by the GDPR, it is the legal framework – rather than donor choice – that ultimately determines when and how such data may be processed. This means withdrawal offers only limited control: although consent can be revoked, data may still be stored and used under alternative legal bases. As a result, exercising the right to withdraw does not necessarily affect the legitimacy of future use of biobank data. In practice, samples may be destroyed, but personal data remain available for research. This raises an important question: how are donors informed of the practical consequences of exercising the right before obtaining their consent?
This paper analyses two biobank consent documents – one from Finland and one from Germany – to examine how the implications of consent withdrawal are communicated to donors. The analysis finds that both documents convey potentially misleading information about the practical consequences of consent withdrawal. In doing so, they risk giving the impression that the right to withdraw from biobank research is more powerful than it is.
Two moral issues arise from communicating potentially misleading information about the implications of consent withdrawal. First, if withdrawal is presented as having more effect on future use of biobank materials than it truly does, donors may overestimate their control and become more inclined to consent than refuse. While this benefits biobank research, it undermines informed consent. Second, if donors feel misled, trust in biobank research and institutional transparency may erode. Donors should therefore be given accurate and accessible information about the legal consequences of consent withdrawal.
Right to withdraw consent
The right to withdraw from research is a well-established principle in human research. Ethics guidelines generally frame this right as absolute and unconditional, but scholarly debate presents a more nuanced view, emphasising the need to balance the individual right against the collective benefits of continued research, particularly in the biobank context. This section examines the normative framing of withdrawal in guidelines and scholarship, before turning to its legal impact under the GDPR.
Guidelines, recommendations, and ethical standards
This section examines a set of softlaw 1 documents (e.g., guidelines, recommendations, ethical standards), focusing on their provisions regarding the right to withdraw consent from research. These instruments are adhered to by the European Research Infrastructure Consortium’s (ERIC) Biobanking and Biomolecular Resources Research Infrastructure (BBMRI), a pan-European infrastructure supporting biobank research by providing access to biological samples and data across Europe (BBMRI-ERIC, 2024). Accordingly, for biobanks operating within the BBMRI-ERIC network, these instruments apply in addition to the relevant national regulatory frameworks.
Some documents establish the right to withdraw consent without specifying what should happen afterwards. The most recent amendment to the World Medical Association’s (WMA) Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Participants (2024) affirms that participants must be informed of their right to withdraw at any time without reprisal. The WMA Declaration of Taipei on Ethical Considerations Regarding Health Databases and Biobanks (2016) further specifies that individuals may, at any time and without reprisal, alter their consent or request the withdrawal of identifiable data from a health database and biological material from a biobank.
Other documents go further by prescribing actions that should follow withdrawal. According to the Best Practices Recommendations for Repositories by the International Society for Biological and Environmental Repositories (ISBER, 2023: 56), participants should have the right to withdraw consent and have identifiable specimens and data removed from the repository. The International Ethical Guidelines for Health-Related Research Involving Humans by the Council for International Organizations of Medical Sciences (CIOMS) (2016: 44) provide a more detailed framework: donors, or their legal representatives, may withdraw consent for the use of biological material stored in a biobank, after which samples should either be destroyed or returned, and any future use of samples or data prohibited. Similarly, the International Declaration on Human Genetic Data by the United Nations Educational, Scientific and Cultural Organization (UNESCO) (2003) recommends that, if a person withdraws consent, samples and associated data should no longer be used unless irretrievably unlinked from the individual concerned.
One document suggests that there may be limitations to the right to withdraw, of which the donor should be informed. The Recommendation of the Council on Human Biobanks and Genetic Research Databases by the Organisation for Economic Co-operation and Development (OECD) (2009: 9, 33) advises that human biobanks and genetic research database operators should inform participants about both the implications and the limitations of exercising their right to withdraw. For instance, the Recommendation notes that the sharing of data restricts the possibility of complete withdrawal – namely, the destruction of samples and associated data.
In conclusion, the soft law documents examined here largely portray the right to withdraw consent as absolute – that is, unconditional, and exercisable at any time without reprisal. They typically present withdrawal as complete, requiring the cessation of all future use of personal data and biological material. While some, such as the OECD Recommendation, acknowledge limits (e.g., shared data cannot be fully withdrawn), the overarching implication is that continued use of biobank materials after withdrawal should not be permitted. By contrast, the following section turns to scholarly debate, which questions whether the right to withdraw can – or should – be treated as absolute in the context of biobank research.
A critical look at the right to withdraw consent
The scholarly debate surrounding the right to withdraw consent questions its absolute and unrestricted application in the context of biobank research. This section outlines the debate, highlighting that, under certain conditions, limiting or modifying the right can be ethically justifiable.
Eriksson and Helgesson (2005) challenge the uncritical extension of the far-reaching right to withdraw from human subject research into the ethics of biobank research without modification. They argue that, as biobank research involves no risk of direct physical harm, it should be treated as a distinct category – more akin to register-based research than traditional human subject research. Accordingly, the withdrawal of consent need not necessarily preclude further research on identifiable materials. Rather, a biobank might accept a withdrawal request only if the sample donor can present a sufficient reason for doing so 2 . Moreover, they contend that anonymisation should not be an automatically permissible response to withdrawal requests, as it prevents further use of biobank materials for research and does not effectively protect donors’ privacy.
Holm (2011) draws attention to the potential societal cost of preserving an unrestricted right to withdraw consent from biobank research. Since biobank research depends on representative cohorts, preserving such a right can result in the loss of scientific value of existing cohorts as well as financial damage to investments in biobanking. Given the gravity of this potential impact, Holm suggests that if it is possible to modify the right without significant ethical costs, there is good reason to do so. Specifically, he proposes that a withdrawal request need not have an immediate and complete effect. Instead, it could trigger a cooling-off period during which the use of biobank materials ceases, but the materials themselves are not yet destroyed. If the individual confirms the withdrawal at the end of this period, destruction could then proceed. If completeness of withdrawal is interpreted to mean full erasure of both samples and data, an alternative could be anonymisation of data and samples with or without permission to generate further data, or enabling donors to selectively withdraw consent for certain projects while permitting others.
In light of this debate, there are good reasons to limit the impact of exercising the right to withdraw consent on biobank materials and their subsequent use. Interestingly, the current data protection framework in the EU/EEA produces a comparable outcome: personal data may continue to be used for research even after consent to biobank participation has been withdrawn. The effect is that, much like the proposals advanced in the scholarly debate, the practical impact of withdrawal is limited, since data may still be stored and processed on alternative legal bases. The following section explains how such continued use remains legally permissible despite withdrawal of consent.
Consent withdrawal under the GDPR
This section examines how the legal basis for processing personal data shapes the effect of withdrawing biobank consent. The effect of withdrawal depends on the scope of the original consent, which in turn depends on the legal ground chosen for processing data derived from samples. Biobank research involves both the use of biological samples and the processing of associated personal data. Typically, samples are used on the basis of donor consent under national law 3 , while data processing is governed by the GDPR, which permits several legal bases. This article, therefore, distinguishes between GDPR-based consent (broad scope, covering samples and data) and ethical consent (narrow scope, covering only samples). The following analysis considers two legal bases and their consequences for withdrawal: consent by the data subject and public interest.
Consent by the data subject
Under the GDPR, consent is one of six legal bases for processing personal data (Art. 6(1)(a)) and one of ten exceptions available to data controllers for processing of special categories of data, such as health data (Art. 9(2)(a)). Where this legal basis is used, the withdrawal of consent in biobank research applies, in principle, to both samples and data, as Article 7(3) grants data subjects (here: the sample donor) the right to withdraw consent to the processing of personal data.
The European Data Protection Board (EDPB) (2020: 24, paras 117, 120) interprets withdrawal to mean that controllers (here: biobanks) must end all processing based on consent and, in principle, erase the data, unless another lawful basis justifies continued use.
Legal scholarship has added further nuance to this interpretation. Florea (2023) examines how withdrawal functions in the context of health research and emphasises that the GDPR does not establish correlative obligations for controllers tied specifically to the act of withdrawal. This, he suggests, may be explained by the provision’s structural placement: withdrawal appears in Chapter II (Principles) rather than Chapter III (Rights). On this reading, withdrawal is not a strict and immediate mandate but a principle whose effect depends on context and may be balanced against competing interests, such as research integrity and reproducibility. Far from contradicting the EDPB’s position, this analysis reinforces its caveat that continued processing remains permissible where another legal basis applies.
This structural weakness suggests that withdrawal of consent for personal data processing operates more as a principle than as an absolute right, leaving donor control weaker than it may first appear, since research data can still be retained and used under alternative grounds.
Public interest
Public interest is another legal basis for data processing under Article 6(1)(e) GDPR and is included in conditions under Article 9(2) for processing special categories of personal data. Where this basis is used, withdrawing biobank consent may only affect the use of samples for research, but the data derived from them may nevertheless continue to be stored and used.
In this context, the GDPR’s main safeguard for donors is the right to object under Article 21(1). If exercised, the biobank must stop processing, but exceptions exist if compelling grounds override donor interests. Article 21(6) narrows this further in scientific research: objection is allowed only on grounds related to the donor’s situation, and processing may continue if necessary for a task in the public interest. Thus, while objection is a safeguard, it does not guarantee cessation of data use.
Accordingly, when public interest is the legal basis, withdrawal of biobank consent does not stop data processing, which may lawfully continue for research. Donors may object to the processing, but this right remains limited and subject to override.
To conclude, this section shows that, irrespective of the legal basis, a sample donor’s control over their personal data can legitimately be restricted. While consent withdrawal may affect the permissibility of continued use of biological samples, its impact on the continued use of personal data can be far more limited. This raises the question: how are donors informed about the legal consequences of consent withdrawal before obtaining their consent? The extent to which these legal limitations are communicated to donors is critical for facilitating informed decision-making about research participation. The following section, therefore, turns to two examples of consent documents, examining how the right to withdraw consent and the consequences of exercising it are communicated to donors.
Evidence from consent documents
This section analyses two consent documents from two different EU member states. The aim is to assess what these documents are likely to convey to an ordinary reader, understood as someone without prior knowledge of how biobank research or personal data are regulated. The broader purpose is to evaluate whether the consent documents, as such, support informed decision-making about participation in biobank research.
Data
The data consist of two sets of consent documents: one from University Greifswald Medicine (UMG) in Germany and one from the Helsinki Biobank (HB) in Finland. These documents exemplify different informed consent practices, each reflecting a distinct way of structuring donor consent.
UMG employs what its developers call a data protection–compliant broad consent, which enables consent to serve as the legal basis for processing personal data. Broad consent refers to permission for an open-ended range of research purposes, without tying consent to a single, narrowly defined study. Under the GDPR, however, consent can only function as a valid legal basis if it meets certain conditions, including the requirement of specificity (Art. 4(11)). To reconcile this tension, the Medizin-Informatik Initiative (MII) developed a standardised format for use by biobanks across the federal states in Germany. As Zenker et al. (2022) argue, this format makes broad consent data protection-compliant by addressing the specificity requirement: it obliges biobanks to publish information about planned research projects in advance, thereby allowing donors to monitor ongoing research and withdraw consent if they wish. In this way, broad consent is adapted to the GDPR, and thus qualifies as GDPR-based consent, that is, consent with a broad scope (see previous section).
In Finland, by contrast, research biobanks rely on public interest as the legal basis for processing personal data. Under section 11a of the Biobank Act (688/2012), the processing of biobank data is grounded in public interest in accordance with Article 6(1)(e) and Article 9(2)(i) GDPR, while broad consent is used only to authorise the use of biological samples. Because public interest rather than consent underpins the processing of data derived from samples, Finnish biobank consent functions as ethical consent with a narrow scope (see previous section).
Method
The consent documents are analysed using a Gricean content analysis, which considers not only their literal contents but also what they are likely to communicate to an ordinary reader. Paul Grice (1975: 43–44) observed that in linguistic exchanges, we often convey more than we explicitly state through implication, that is, meaning suggested or inferred rather than directly expressed. Coppock and Champollion (2024: 13) emphasise that the notion of implication is central to understanding: to understand something is to determine its implications, and if none arise, there is a gap in comprehension. A key advantage of this approach is that it reflects the inferential nature of communication (Kaaya, 2024): readers of consent documents draw not only on explicit wording but also on context, prior knowledge, and shared norms of linguistic exchanges. Gricean analysis thus captures both what is explicitly said and what can be inferred, clarifying how messages are conveyed and interpreted.
To see how this works in practice, it is useful to distinguish different kinds of implications. Some are semantic, arising from the structure of a sentence and the meanings of its words. These include entailments, where the truth of one sentence guarantees the truth of another – for example, I speak Spanish and French entails that I speak Spanish. They also include presuppositions, background assumptions built into the sentence itself – for instance, I no longer speak French presupposes that I once did.
In contrast to these semantic types, Grice (1975: 45) introduced a different category: pragmatic implication 4 . This depends on how expressions are interpreted in context, based on the assumption that linguistic exchanges are cooperative activities governed by conversational norms – the Maxims of Conversation – which guide speakers to contribute in ways that promote effective communication. For example, if someone says I speak Spanish and French in response to a question about language skills, this may implicate that these are the only two languages spoken, particularly if full disclosure of competencies is expected.
Grice (1975: 45–48) identified four Maxims:
(1) Maxim of Quantity: be as informative as possible for the current exchange, but only as informative as required.
(2) Maxim of Quality: do not say what you believe to be false or for which you lack adequate evidence.
(3) Maxim of Relation: say things and only those things that are relevant for the discussion.
(4) Maxim of Manner: be brief and orderly, and avoid ambiguity and obscurity.
Although these Maxims operate implicitly, we notice them when they are breached. Suppose a researcher tells a participant that data will be used to study genetic factors in type II diabetes. If those data are later also used in schizophrenia or inbreeding research, the participant may feel misled. The researcher did not explicitly state that no other uses would occur, but by mentioning only one purpose in a context that calls for full disclosure, the response implicates exclusivity – a breach of Quantity (insufficiently informative) and, arguably, Relation (withholding relevant uses).
This study analyses both semantic and pragmatic implications, treating them as inferred contents – what an ordinary reader could reasonably take a sentence to mean in context – in addition to its bare literal meaning. Such inferences are potential inputs to belief and are shaped by the broader textual setting, including the presence or absence of qualifying information. The analysis focuses only on passages directly relevant to the right of withdrawal and its consequences, proceeding in four stages: (1) extracting relevant passages; (2) checking the consistency of their literal content with laws and policies; (3) analysing the relevant semantic and/or pragmatic implications; and (4) assessing the truth value of these inferences, understood as their consistency with the applicable normative framework.
Analysis
This section applies the Gricean content analysis to the consent documents introduced above, examining what an ordinary reader might infer regarding the right to withdraw and its consequences. The analysis begins with the UMG documents and then turns to those of the HB. Summaries are presented in Table 1 (UMG) and Table 2 (HB).
University Medicine Greifswald (UMG) – Summary Table 1.
Helsinki Biobank – Summary Table 2.
As some of the sentences analysed below permit multiple legitimate readings, each is presented in a breakdown format immediately below the quoted sentence to indicate the analysed reading. Also, the parts of sentences that are directly relevant for the present analysis are marked in italics.
University Medicine Greifswald
The UMG Consent Document (Annex I) 5 is based on a template from the Medizin-Informatik Initiative (MII) (Annex II). It is divided into two parts: an Information Disclosure, which provides donors with details about the research and governance framework, and a Consent Declaration, in which donors formally state their consent. In the latter, on pages 1–2, patients 6 are asked to consent to the scientific use of: (a) patient data 7 , (b) biomaterials (tissue and fluids), and (c) possible re-contact. These elements together define the legal scope of consent and the actions from which consent may later be withdrawn.
The first provision relevant for withdrawal of consent reads as follows: [1] If you do not want to participate, or if you wish to withdraw your consent later, you will not suffer any disadvantages. (UMG – Information Disclosure, p. 1)
Sentence [1] states that if the patient does not want to participate or wishes to withdraw consent later, she will not suffer any disadvantages.
Normative consistency
Sentence [1] is consistent with the ethical requirement that participation in research be voluntary, as emphasised by the Deutscher Ethikrat (2010: 39) in its Opinion on Human Biobanks for Research. It is also consistent with the GDPR, since Article 7(3) grants data subjects the right to withdraw consent, which the UMG Consent Document identifies as the legal basis for data processing.
Inferred meaning
Sentence [1] semantically implies that patients have the right to withdraw consent, since it presupposes the existence of this right. This implication is true. The GDPR explicitly recognises this right (Art. 7(3)), and the Deutscher Ethikrat (2010: 38, 40) likewise stresses that donors must be able to revoke consent and be informed of this possibility with respect to both samples and personal data. For an ordinary reader, the sentence supports the true belief that she has the right to withdraw consent.
The next provision concerns a consequence of consenting to the scientific use of biomaterials: it entails a transfer of legal ownership of biomaterials. The Document sets out this transfer as follows: [2] By consenting to the collection, storage, and scientific use of your biomaterials, ownership of these materials is simultaneously transferred to University Medicine Greifswald. (UMG – Information Disclosure, p. 5)
Sentence [2] states that consenting to the collection, storage, and scientific use of biomaterials amounts to a transfer of ownership of these materials to the UMG.
Normative consistency
Sentence [2] is consistent with the German Civil Code (Bürgerliches Gesetzbuch, BGB), which under §953 provides that separated products and components remain the property of the owner of the original thing. Thus, the removed biological materials belong to the sample donor. Ownership, however, may be transferred – or rights of use granted – if such transfer is explicitly declared (Goebel and Scheller, 2019). The UMG Consent Document contains this declaration, stating that consent to the collection, storage, and scientific use of biomaterials constitutes a transfer of ownership to the UMG. Without such wording, no transfer of ownership would occur (Simon et al., 2006, p. 41).
Inferred meaning
A semantic implication of sentence [2] is that the donor relinquishes control of the biomaterials while the UMG acquires it. This follows from the ordinary meaning of transfer of ownership, which typically refers to a shift of control from one party to another. The implication is legally correct: under §903 BGB, an owner may, unless restricted, use a thing at their discretion and exclude others. As Simon et al. (2006, p. 31) note, the owner of a biological sample holds all legally permissible rights to use and dispose of it. Yet in this context, this implication is inaccurate. While sentence [2] suggests that ownership, and thus control, passes from the donor to the UMG, sentence [4] (discussed in detail below) will clarify that the donor retains certain rights despite the transfer. Thus, although ownership is formally transferred under the UMG Consent Document, it does not entail unfettered control for the UMG.
The Document next clarifies that the transfer of ownership of biomaterials does not extend to personal data: [3] Your right to control the processing of your personal data remains unaffected by the transfer of ownership. (Information Disclosure, p. 5)
Sentence [3] states that the patient’s right to control the processing of her personal data remains unaffected by the transfer of ownership [of biomaterials].
Normative consistency
Sentence [3] is consistent with the GDPR. The phrase right to control the processing of personal data refers not to an open-ended entitlement but to the bundle of rights granted to data subjects under Articles 12–21 GDPR, including access, rectification, erasure, restriction, objection, and portability. These rights give donors a legally defined degree of influence over the processing of their personal data, and they remain intact even after ownership of biomaterials is transferred to UMG.
Inferred meaning
Sentence [3], however, can mislead. By omitting the legal qualifications and limits of data subjects’ rights under the GDPR – especially those applying to personal data processed for scientific research – the Document suggests that the right to control is unrestricted. This omission breaches the Maxims of Quantity and Relation, as it withholds information relevant to interpreting the normative force of the sentence.
The wording reinforces this effect. The phrase right to control appears familiar and may be read as an absolute entitlement, something inherently possessed and freely exercisable. Legally, however, it refers to the structured set of data subjects’ rights, which themselves contain built-in conditions and exceptions, and are subject to balancing against other rights and interests. Furthermore, Article 89 GDPR allows Union or Member State law to restrict some of these rights (i.e., rights of access, rectification, or objection) when necessary to safeguard scientific research, provided appropriate safeguards of privacy are in place. This ambiguity breaches the Maxim of Manner by using deceptively familiar terminology.
Together, these breaches of the Maxims risk generating the false implication that the right to control personal data is unrestricted, justifying the corresponding belief.
The Document then introduces a provision stating that, despite the transfer of ownership, the donor retains two entitlements: [4] Despite the transfer of ownership, you can withdraw your consent to data processing at any time (see Point 5) and request the destruction of your biomaterials. (p. 5)
Sentence [4] contains two parts: despite the transfer of ownership, the patient can: [4a] withdraw consent for data processing at any time, and [4b] request the destruction of her biomaterials.
Normative consistency
Sentence [4] is consistent with the law. Sentence [4a] reflects the GDPR: consent is the legal basis for processing personal data, and data subjects have the right to withdraw consent at any time (Art. 7(3) GDPR). The transfer of ownership of biomaterials cannot override this right. Sentence [4b] is less straightforward, as transfer of ownership normally extinguishes proprietary rights. However, German law allows contractual entitlements: as the Consent Working Group of the the National Steering Committee of the BMBF’s Medical Informatics Initiative (Consent Working Group of the National Steering Committee of the BMBF’s MII, 2020: 4) notes, withdrawal of consent can give patients a contractual right to request destruction. Such a claim may arise from a treatment contract or from institutional policies incorporated into the consent process in accordance with §305 BGB, which governs the inclusion of standard contract terms. Sentence [4] thus reflects two withdrawal regimes: one grounded in the GDPR (withdrawal of consent for personal data processing) and one in the contractual framework of the UMG Consent Document (the right to request destruction of biomaterials).
Inferred meaning
A semantic implication of [4a] is that the patient has the right to withdraw consent to the processing of her personal data. This arises because the sentence, again, presupposes the existence of this right. However, by omitting relevant information about its scope (see section Consent Withdrawal under the GDPR), it further pragmatically implies that the right is unrestricted, in breach of the Maxims of Quantity and Relation. An ordinary reader may therefore believe, correctly, that she has the right to withdraw consent, but also believe, incorrectly, that this right is unrestricted.
A semantic implication of sentence [4b] is that, despite the transfer of ownership of biomaterials, the patient has the right to request their destruction. Like [4a], this implication arises through presupposition: the sentence takes the continued existence of the right for granted. The implication is legally sound, as such rights can be incorporated under §305 BGB. It mitigates the earlier implication of sentence [2] that ownership transfer extinguishes all control, reassuring donors that they retain a measure of influence. An ordinary reader is thus justified in believing that she may request the destruction of her biomaterials even after ownership has been transferred.
What, then, follows from consent withdrawal? The Document provides the following provision, specifying the consequences of withdrawing consent: [5] In the event of a withdrawal, the biomaterials you provided for research will be destroyed, and your patient data stored based on this consent will be deleted or anonymised, provided this is legally permissible. (Information Disclosure, p. 6)
Sentence [5] contains three parts: in the event of a withdrawal, [5a] biomaterials will be destroyed, and patient data stored on the basis of this consent will be [5b] deleted or [5c] anonymised, provided this [i.e., deletion or anonymisation] is legally permissible.
Normative consistency
Sentence [5a] is consistent with the contractual promise incorporated into the UMG Consent Document. As previously noted, the UMG can be considered contractually obligated to destroy biomaterials upon withdrawal, given that this obligation is validly grounded in the terms of consent.
Sentence [5b] is more complex. The Document does not clarify what patient data stored based on this consent refers to. If read narrowly as research-specific data collected under consent, it is unclear why deletion would ever be legally impermissible. This suggests a broader reading that also covers data generated in the course of clinical care. On this interpretation, the proviso makes sense: under § 630f(3) BGB, medical records must be retained for ten years after treatment, so deletion becomes permissible only once this period has elapsed. Even then, deletion is not assured. Article 9(4) GDPR allows Member States to establish additional legal bases for processing sensitive data, and Germany has done so: § 27 Bundesdatenschutzgesetz (BDSG) and § 9(1) Landesdatenschutzgesetz Mecklenburg-Vorpommern (DSG M-V) permit processing of health data for research without consent (Bundesdatenschutzgesetz, 2017; Landesdatenschutzgesetz Mecklenburg-Vorpommern, 2018). These alternative legal bases may apply not only once the retention period has expired but also while it is still running, meaning that even if a patient withdraws consent, continued processing may remain lawful.
Sentence [5c] concerns anonymisation of patient data. It is consistent with the contractual promise made in the UMG Consent Document, which commits UMG to delete or anonymise data upon withdrawal, provided this is legally permissible. Yet anonymisation, like deletion, is only possible once clinical care needs and statutory retention obligations have expired. In that narrow window, anonymisation may serve as a substitute for deletion, consistent with legal scholarship holding that true anonymisation can satisfy the erasure obligation under the GDPR (Dierks et al., 2021: 52).
Taken together, [5b] and [5c] are consistent with the contractual promise made in the Document, but only in a very restricted set of circumstances. In practice, the legal conditions that must be met mean that the promise can rarely be realised.
Inferred meaning
An ordinary reader may rightly infer from [5a] that, upon withdrawal, biomaterials will be destroyed without exception. The use of will conveys certainty and, in a formal context, may signal a promise rather than a prediction, creating an apparent obligation (Searle, 1969: 57–60). The absence of qualifications strengthens this reading: by the Maxims of Quantity and Relation, if exceptions existed, they would have been stated.
By contrast, [5b–c] risk leading readers to overestimate the effect of withdrawal. The implication is that deletion or anonymisation is the norm, while continued identifiable retention is the exception. This, again, arises partly from the use of will, which conveys certainty and promissory force, and partly from the proviso provided this is legally permissible. The Document breaches the Maxims of Quantity and Relation by withholding essential information about the circumstances under which deletion or anonymisation is legally permissible. It also breaches the Maxim of Manner by remaining vague, since it fails to specify the precise legal conditions that apply. In the absence of clarification, an ordinary reader may reasonably assume that the proviso is rarely triggered and infer that withdrawal usually results in deletion or anonymisation, even though, as noted above, such outcomes are possible only in very limited circumstances.
A further issue is the lawfulness of continued processing where consent is withdrawn but deletion or anonymisation is not possible. Since all processing requires a legal basis, it may continue under § 27 BDSG or § 9(1) DSG M-V, which permit non-consensual research use when necessity and proportionality are met. The Document does not mention these provisions, heightening the risk that donors overestimate the effect of withdrawal.
An ordinary reader is thus justified in believing, correctly, that withdrawal leads to the destruction of biomaterials without exception. She may also believe, incorrectly, that withdrawal normally results in deletion or anonymisation of personal data, when in fact continued identifiable storage is the rule.
Overall, the UMG Consent Document communicates relatively clearly the existence of the right to withdraw consent, most notably through the unqualified commitment to destroy biomaterials upon withdrawal ([5a]). This provision conveys certainty and aligns with contractual and ethical obligations, so donors are unlikely to be misled. Where the Document falls short is in explaining the consequences of exercising this right with respect to personal data. Provisions concerning data ([5b–c]) are phrased vaguely, rely on an undefined qualification, and omit reference to alternative legal bases that may allow processing to continue. As a result, while patients are made aware that they can withdraw consent, the implications of doing so remain obscured. This risks generating false expectations, especially the belief that withdrawal normally results in deletion or anonymisation, when in reality, continued identifiable storage is the norm. In this way, the Document provides clarity about the formal existence of rights, but obscures some of their practical effects, thereby undermining the possibility of fully informed decision-making.
Helsinki Biobank
In the HB Consent Declaration Document (Annex III), donors confirm they have read the HB Information Leaflet (Annex IV) and consent to two actions: (a) the collection and transfer of samples, including previously collected ones, to the HB, and (b) the collection and transfer of sample-related information. These define the legal scope of HB consent and what may later be withdrawn.
The HB Declaration does not seek consent for the processing of personal data. As noted earlier, in Finland, such processing in biobank research is based on public interest (§11a Biobank Act 688/2012; Arts. 6(1)(e), 9(2)(i) GDPR). Thus, while donors agree to transfer samples and related information, subsequent data processing does not rest on consent. Withdrawal, therefore, does not affect personal data processing; donors must instead rely on their right to object under Art. 21(1) GDPR if they wish to oppose the use of their data.
Against this background, the HB Information Leaflet informs donors about the procedures for withdrawing consent and exercising the right to object: [1] You can withdraw your consent and exercise the right to object under Article 21 GDPR by submitting a signed refusal to the HB, a healthcare unit, or research personnel.
Sentence [1] has two components: it states that by submitting a signed refusal, the donor can: [1a] withdraw consent and [1b] exercise the right to object under Article 21 GDPR.
Normative consistency
Sentence [1] is consistent with the law. Sentence [1a] is consistent with §12 Biobank Act (688/2012), which grants donors the right to withdraw consent for the use of their samples. Sentence [1b] is consistent with both the Biobank Act and the GDPR: since biobank data are processed on the basis of public interest (§11a Biobank Act; GDPR Arts. 6(1)(e), 9(2)(i)), donors hold the right to object under Art. 21(1) GDPR.
Sentence [1] therefore illustrates that HB consent functions only as ethical consent, because it introduces the right to object – a safeguard that applies precisely when personal data are processed on a public interest basis rather than on the basis of consent.
Inferred meaning
Sentence [1] may convey only a vague or incomplete meaning to an ordinary reader, because the Leaflet omits the contextual information needed to explain how withdrawal and objection differ. This omission breaches the Maxims of Quantity and Relation, as the Leaflet does not provide sufficient background to distinguish between the two rights. As a result, the reader may draw a faulty inference – most likely that withdrawal and objection are equivalent and produce the same effects. An ordinary reader could therefore reasonably, though incorrectly, infer that the two rights are interchangeable, despite their distinct legal bases and consequences.
In practice, however, withdrawal under §12 Biobank Act (688/2012) concerns consent for the transfer of samples and associated information, whereas objection under Article 21 GDPR addresses personal data processing carried out on the public interest basis (§11a Biobank Act; GDPR Arts. 6(1)(e), 9(2)(i)). This distinction significantly limits the scope of withdrawal and thus requires explicit clarification.
The Leaflet’s reference to Article 21 GDPR does little to reduce this lack of clarity. Understanding its significance requires prior knowledge that data processing must rest on a legal basis, that in Finland, this is public interest (§11a Biobank Act; Art. 6(1)(e) GDPR), and that this gives rise to a conditional right to object. Because this presupposes technical knowledge, sentence [1b] may not communicate anything meaningful to an ordinary reader. The use of specialised legal terminology further breaches the Maxim of Manner.
Taken together, the Leaflet’s communicative choices constitute clear breaches of the Maxims of Quantity, Relation, and Manner. These breaches either leave the donor with no substantive understanding of the right to object or foster the false inference that withdrawal and objection are co-extensive. In either case, the ordinary reader is left without accurate and accessible information about the scope of her rights and the consequences of exercising them.
The Leaflet then moves to a new provision, specifying the consequences of exercising the right to object: [2] By exercising the right to object, you can prevent the use of your information by the biobank.
Sentence [2] states that by exercising the right to object, the donor can prevent the use of her information by the biobank.
Normative consistency
Sentence [2] is consistent with §12a Biobank Act (688/2012), which provides that an objection means that samples and associated personal data may no longer be used for biobank research.
Inferred meaning
Despite being legally accurate, sentence [2] risks generating two false implications. First, it pragmatically implies that by objecting, the donor can prevent any further use of her data. This follows from the omission of contextual information about the scope of lawful processing: the leaflet does not mention that data may still be processed under public interest or other legal bases, thereby breaching the Maxims of Quantity and Relation. The wording reinforces this effect: it states that the donor can prevent further use of her data by the biobank. For an ordinary reader, and in the absence of qualifications, this may suggest that the biobank is the only body using the data, which strengthens the implication that objection ends all data use. Yet this is misleading: the biobank is not in fact the only possible data user. In the HB Consent Document, Helsinki University Hospital (HUS) is designated as the controller.
The second implication is semantic. The term prevent implies that objecting categorically halts further use of the data. This implication is reinforced by the omission of the legal limits of the right to object. In fact, Article 21 GDPR allows processing to continue if the controller (here: the biobank) demonstrates compelling legitimate grounds. The semantic force of prevent, combined with breaches of the Maxims of Quantity and Relation, fosters the false belief that objection absolutely terminates all further processing.
In practice, the scope of the right is narrower. Under §11a of the Biobank Act, biobank processing is permitted only on public interest grounds. Exercising the right to object under §12a requires the biobank to stop using data derived from samples (e.g., genomic data) for biobank research 8 , but this restriction does not apply in other contexts. The Finnish Data Protection Act (§6) still authorises processing for public interest, while §19 prohibits only specific uses such as in criminal investigations, insurance, or employment decisions.
Practice also shows that data is used outside biobank research. The HB has provided data for clinical care and, on at least one occasion, to the police to assist in identifying a deceased person 9 . Although data protection law does not apply to deceased individuals, this underscores the broader point: objection stops biobank research use but need not terminate all processing. An ordinary reader is therefore justified in believing that an objection prevents research use of her data, yet risks being misled into the false belief that it halts all further processing.
Finally, the Leaflet turns to a provision that outlines what follows from submitting a signed refusal: [3] Your samples will be destroyed, and information, including any health-related information possibly analyzed from your biobank sample, will be removed from the biobank registry.
Sentence [3] consists of two parts. It states that, upon submitting a signed refusal, [3a] samples will be destroyed, and [3b] information, including any health-related information possibly analysed from the sample, will be removed from the biobank registry.
Normative consistency
Sentence [3a] is consistent with HB’s declared practice: the biobank commits to destroying samples upon receipt of a signed refusal 10 . The Biobank Act (688/2012) imposes no statutory requirement to this effect, but HB’s policy provides the operative basis.
Sentence [3b], however, is inconsistent with both law and practice. In practice, information derived from samples is not erased but remains stored – for instance, in laboratory information systems or virtual machines – where pseudonymisation may be applied, but the data remains accessible for verification. 11 Legally, the claim is equally inaccurate: neither withdrawal nor objection entails erasure of data already held. Article 21 GDPR grants data subjects the right to object to processing for research, but it does not oblige the deletion of data previously collected. Sentence [3b] therefore misrepresents both HB’s operational procedures and the governing legal framework.
Inferred meaning
Sentence [3a] implies necessity semantically and pragmatically. By stating that samples will be destroyed, it suggests destruction occurs without exception or institutional discretion. As noted earlier, in an institutional context, the verb will carries promissory force, strengthening the impression that destruction is inevitable. While the belief that destruction follows withdrawal aligns with HB’s declared policy, the stronger implication – that it occurs necessarily – is false. Under §7 Biobank Act (688/2012), HB becomes the owner of the samples and thus retains discretion to revise its policy. Moreover, unlike Germany, where biobank consent may in principle create contractual obligations, Finnish law recognises only ethical or normative force. These features mean that the HB’s commitment cannot be binding in law, even though it is presented as categorical. Sentence [3a] therefore breaches the Maxims of Quantity and Relation by omitting this crucial qualification, supporting the false belief that destruction follows withdrawal in all cases, without exception.
Sentence [3b] presents an even more serious case. The categorical formulation will be removed not only asserts erasure as fact but also signals inevitability with promissory force, leaving no room for qualification. Unlike sentence [3a], which overstates the legal force of an existing policy through implication, sentence [3b] communicates a direct falsehood: in law and in practice, complete erasure does not occur. Because this message is conveyed explicitly rather than through inference, donors are especially likely to acquire the false belief that withdrawal guarantees total data removal. Sentence [3b] thus represents a clear violation of the Maxim of Quality, presenting as certain an outcome that HB neither delivers nor is required to deliver, and thereby maximising the risk of donor misunderstanding.
Taken together, sentence [3] reveals a gap between communicated commitments and both law and HB’s actual procedures. While sentence [3a] reflects current practice, it overstates its legal force by presenting a discretionary policy as categorical. Sentence [3b], however, goes further, misrepresenting both law and practice by promising erasure that will not occur. The Leaflet thus breaches the Maxims of Quantity, Relation, and Quality, fostering false beliefs about the consequences of withdrawal. As a result, donors are likely to overestimate their control, undermining the validity of informed consent.
In sum, the HB Information Leaflet communicates some aspects of withdrawal relatively well. The promise to destroy samples upon receipt of a signed refusal ([3a]) is clear and consistent with HB’s current practice, though it overstates its force by omitting that, under §7 Biobank Act, HB retains discretion as the legal owner of the samples. More generally, the provisions in sentences [1], [2], and [3] are legally accurate, but the Leaflet’s failure to qualify them with essential context is likely to create misleading impressions. Without clarification, sentence [1] fosters the false belief that withdrawal and objection are equivalent; sentence [2] fosters the belief that objection halts all further data use; and most seriously, sentence [3b] misrepresents both law and practice by promising erasure of all health-related data – an outcome HB does not in fact deliver. In particular with respect to data, the information disclosure is not merely misleading but a direct misrepresentation of both law and practice, creating false assurances about the consequences of withdrawal. These communicative choices are likely to leave donors with an inflated sense of control over their samples and data.
Discussion
This paper has examined biobank consent documents from Germany (University Medicine Greifswald, UMG) and Finland (Helsinki Biobank, HB) to evaluate how they inform donors about the right to withdraw and the consequences of exercising it. Both acknowledge this right but misrepresent or obscure its consequences in ways that risk misleading donors.
At UMG, withdrawal is presented as leading to deletion or anonymisation of data as a rule, though in practice this is rare. German law imposes strict retention duties and provides alternative legal bases for continued storage and processing even after withdrawal. At HB, the document blurs the distinction between the right to withdraw and the right to object to data processing, treating them as if they had identical effects. Yet withdrawal applies to biological samples, while objection concerns personal data, and the limitations of the latter are not explained. Most troublingly, the HB document directly misrepresents its practice, stating that all health-related data will be erased upon withdrawal. This is false: while samples may be destroyed, HB retains data, and the law does not require erasure.
Such communicative shortcomings foster an inflated sense of donor control. Believing that withdrawal halts all future data use, donors may form false expectations about their rights and the effects of exercising them. By overstating control, the documents jeopardise informed consent, which depends on accurate and comprehensible information.
Importantly, the moral concern does not lie in the scope of the withdrawal right itself, its legal consequences, or the regulation of personal data in the EU/EEA. It lies in the communicative choices made in the consent documents. These choices render the information not only misleading but outright deceptive 12 .
When it comes to linguistic communication, there are at least two ways of causing another to acquire a false belief (Chisholm and Feehan, 1977). The first is straightforward: telling someone something one knows to be false. For instance, in Stanley Milgram’s obedience experiments, participants were told the study concerned learning and punishment, while the real purpose was to investigate obedience to authority (Faden and Beauchamp, 1986: 174). Here, deception operated by asserting a false proposition. The second route involves telling someone something true while omitting crucial information, thereby implying a falsehood. Laud Humphreys’ Tearoom Trade study (1975: 100–105, 113) illustrates this. Participants were recruited under the guise of a health survey, but were not told they had already been covertly observed as part of a surveillance study of public sexual encounters. The disclosed details were technically true, but Humphreys withheld essential facts about the nature of the research and his role in it. Anticipating criticism, he insisted he had given less than full representation rather than falsehoods. Yet the omissions decisively shaped participants’ understanding and lowered barriers to participation; had they known the full truth, many might have refused to take part.
By analogy, both forms of deception appear in the examined biobank documents: in HB, direct falsehoods about the erasure of health data; in both, selective truths that obscure the real consequences of withdrawal. This is morally troubling because the deception concerns a donor’s very right to withdraw. By overstating its effects, the documents withhold information that could be decisive for the decision to participate.
Information about the right to withdraw is arguably all the more relevant in light of empirical findings. Studies show that the mere availability of a withdrawal option can influence willingness to participate in biobanking (Beskow and Dean, 2008; Ahram et al., 2013). If its mere existence can shape decisions to consent, then clarity about its implications is equally important.
Whether deception in human research can ever be justified remains contested. In behavioural studies, it is sometimes permitted when methodologically necessary, scientifically valuable, and risk-free (Beauchamp and Childress, 2019: 130; Miller et al., 2008). The deception in the examined consent documents, however, serves none of these ends. Rather, it undermines informed consent by concealing the implications of withdrawal, thereby making participation appear less objectionable by suggesting that the donor remains in control.
Beyond the moral dimension, these communicative deficiencies also raise legal concerns under the GDPR. Article 12(1) explicitly requires controllers to provide information to data subjects in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. The biobank consent documents fall short of this standard: their wording on withdrawal and objection blurs legal distinctions, obscures crucial details, and risks creating false expectations. In failing to meet the style of communication demanded by Article 12(1), these deficiencies are not only morally troubling but also legally questionable.
To be clear, this analysis does not claim the examined documents render consent legally invalid. Legal validity rests on conditions such as competence, disclosure of required information, and the formal expression of consent. Meeting these requirements may suffice to establish consent in law. Morally, however, consent can be considered transformative only when donors are treated fairly (Miller and Wertheimer, 2010: 94–95). In research settings, fairness requires participants to receive accurate and comprehensible information about key aspects of their involvement. Where this standard is not met, informed consent may be undermined, trust in biobanks eroded, and the moral legitimacy of consent compromised.
Conclusion
In addition to being informed of their right to withdraw consent, donors should be clearly and accurately informed of the legal implications of exercising that right. Specifically, they should be informed about what may happen to the donated samples and the data derived from those samples following withdrawal. This is the central normative implication of the present analysis: ensuring that consent is not only legally valid, but also morally meaningful, requires transparency about the actual consequences of withdrawal. Without such clarity, the moral foundation of consent – and by extension, trust in biobank research – may be undermined.
Supplemental Material
sj-pdf-1-rea-10.1177_17470161251389163 – Supplemental material for Right to withdraw consent from biobank research – A weak right wrapped in empty promises?
Supplemental material, sj-pdf-1-rea-10.1177_17470161251389163 for Right to withdraw consent from biobank research – A weak right wrapped in empty promises? by Emmi J. Kaaya in Research Ethics
Supplemental Material
sj-pdf-2-rea-10.1177_17470161251389163 – Supplemental material for Right to withdraw consent from biobank research – A weak right wrapped in empty promises?
Supplemental material, sj-pdf-2-rea-10.1177_17470161251389163 for Right to withdraw consent from biobank research – A weak right wrapped in empty promises? by Emmi J. Kaaya in Research Ethics
Supplemental Material
sj-pdf-3-rea-10.1177_17470161251389163 – Supplemental material for Right to withdraw consent from biobank research – A weak right wrapped in empty promises?
Supplemental material, sj-pdf-3-rea-10.1177_17470161251389163 for Right to withdraw consent from biobank research – A weak right wrapped in empty promises? by Emmi J. Kaaya in Research Ethics
Supplemental Material
sj-pdf-4-rea-10.1177_17470161251389163 – Supplemental material for Right to withdraw consent from biobank research – A weak right wrapped in empty promises?
Supplemental material, sj-pdf-4-rea-10.1177_17470161251389163 for Right to withdraw consent from biobank research – A weak right wrapped in empty promises? by Emmi J. Kaaya in Research Ethics
Footnotes
Acknowledgements
Not applicable.
Ethical approval
Not applicable.
Informed consent statements
Not applicable.
Funding
The author disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This research is funded by Horizon Europe project “BEYOND: Towards a Behavioural and Evidence-Based Approach to Promote Research Ethics and Research Integrity in Europe (GA 101094714).”
Declaration of conflicting interests
The author declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Potentially identifying information that might compromise anonymity
The text includes a reference to the author’s previously published paper, which analyses the same consent documents using the exact same and unique method.
Data availability statement
Not applicable.
Supplemental material
Supplemental material for this article is available online.
Notes
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
