Retrospective research/research with patient files does not fall under the scope of the WMO as the research subject is not physically involved in the research. The data being researched are also not being gathered for the sake of the research.

The research subjects do not have to change their behaviour for the sake of the research. The only legislation which applies to such retrospective research is the legislation to cover the medical treatment contract, also known as the Agreement on Medical Treatment Act (Wet op de geneeskundige behandelingsovereenkomst, WGBO, in Dutch), from the Dutch Civil Code (Burgerlijk Wetboek) (Book 7, title 7, section 5), and in some cases of course the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp, in Dutch)

The Federa (Dutch Federation of Biomedical Scientific Societies) set up the Code of Conduct for Medical Research (in Dutch). This is a manual for the use of (anonymous) personal information for scientific research.

Rights of the research subjects

The rights of patients are laid down in the regulation concerning the medical treatment agreement. Section 7:457 paragraph 1 of the Dutch Civil Code (Bugerlijk Wetboek) states that the carer ensures that no information on the patient is passed on to third parties without the consent of the patient. The Code does not make any stipulations on the form of consent, so oral consent is in theory sufficient. Legal consent can only be given if the patient has been adequately informed on the access of his or her data by third parties. The patient must be provided with written information upon request. Furthermore, the regulation stipulates that the providing of the patient information may not lead to the private life of another person being impaired.
The Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp, in Dutch) also stipulates that the participant must give explicit consent for every activity related to the personal data, including forwarding the data. In accordance with the Explanatory Statement of the Personal Data Protection Act (Wbp) the participant must have given explicit consent, whether it be written, oral or in a behavioural sense.