File research
Retrospective research/research with patient files does not fall under the scope of the WMO as the research subject is not physically involved in the research. The data being researched are also not being gathered for the sake of the research. The research subjects do not have to change their behaviour for the sake of the research.
The only legislation which applies to such retrospective research is the legislation to cover the medical treatment contract, also known as the Agreement on Medical Treatment Act (Wet op de geneeskundige behandelingsovereenkomst, WGBO, in Dutch), from the Dutch Civil Code (Burgerlijk Wetboek) (Book 7, title 7, section 5), and in some cases of course the General Data Protection Regulation (GDPR).
COREON (Committee on Regulation of Health Research) has drawn up the Code of Conduct for Health Research (in Dutch). This is a manual for the responsible handling of (personal) data and human tissue in health research.
Rights of the research subjects
The rights of patients are laid down in the regulation concerning the medical treatment agreement. Section 7:457 paragraph 1 of the Dutch Civil Code (Bugerlijk Wetboek) states that the carer ensures that no information on the patient is passed on to third parties without the consent of the patient. The Code does not make any stipulations on the form of consent, so oral consent is in theory sufficient. Legal consent can only be given if the patient has been adequately informed on the access of his or her data by third parties. The patient must be provided with written information upon request. Furthermore, the regulation stipulates that the providing of the patient information may not lead to the private life of another person being impaired.
The General Data Protection Regulation (GDPR) also stipulates that the participant must give explicit consent for every activity related to the personal data, including forwarding the data.