ABSTRACT

Retrospective studies are considered among the least harmful clinical studies, since they do not require direct contact with patients. However, as a right that has entered our lives relatively recently, the right to the protection of personal data is a fundamental right and is directly related to the protection of privacy. When considering the data on children, who constitute a vulnerable group, privacy is becoming even more important. Although patients’ data, which have long been considered as the hospital’s data, have not posed significant problems for ethics committees to date. In particular, the growing interest in retrospective research involving artificial intelligence is sparking debates about the protection of personal data, especially for legacy data collected without consent. While regulations on personal data protection permit the use of data for scientific purposes in certain circumstances, the scope of this authorization remains unclear. So this study aims to offer solutions to this problem in light of the global doctrine by explaining the scope of the regulations regarding the right to the protection of data using a definition-based discussion method, and then makes suggestions in comparison with the ethical principles and the laws of other countries.

INTRODUCTION

Whether the legacy data used in the retrospective studies complies with the legal requirements is a matter of concern for ethics committees. When it comes to the use of children’s health data, there is a tendency to approach the matter with greater sensitivity. At this point, there is a misconception that the children’s data is considered sensitive. On the other hand, there is also a misconception that retrospective studies are harmless and there is no need for an ethics committee’s approval for such harmless studies. If the data in question is legacy data, it means the patient data collected before the regulations on personal data protection and the recognition of the right to personal data protection, then there is also a misconception that it is the hospital’s data to be used⁽¹⁾. These misconceptions lead to errors in practice, and they can even lead to the ethics committees making erroneous decisions. However, in clinical studies, ethics committees’ decisions are the most important ethical instruments in research.

When a literature review is conducted on this question, there are almost no studies addressing it. There is only a study from Switzerland, because there is a special provision on waiver consent. However, there is no study that proposes a general solution to this problem in the light of applicable legal text. This study aims to propose a solution to this problem in light of applicable Turkish law, while also examining the relevant international legal texts. So this study will begin with the term ‘retrospective research’ and its scope to be able to conclude why ethics committee approval required for these studies and we will examine its relation with the personal data protection. Then we will discuss the legal status of health data, especially children’s health data, in comparison with the legal status of pre-regulation data. After that, we will discuss the legal status and the availability of unconsented legacy data in the retrospective studies. After discussing the ethical dimension of this situation, we will conclude this study with the suggested legal solutions for this problem.

Retrospective Research

Retrospective studies are conducted by investigating previous patient records already present in the database to achieve a specified outcome⁽²⁾. These are purely observational studies and do not alter existing patient records^{(3, 4)} or require the acquisition of new data. These studies are quite important in medical research because they help confirm discoveries or facts in medical sciences⁽⁵⁾. In these studies many types of personal health data can be used such as laboratory test results, diagnostic, medications, treatments, demographics, etc.⁽⁶⁾. There are two types of retrospective studies: cohort studies and case-control studies. Cohort studies are made by observing one or more groups’ data, while case-control studies are made with the data of those who have the specific diseases or of the “specific cases”⁽⁴⁾.

Retrospective Research and Health Data Protection

In short, the right to the protection of personal data as we know it today was fully recognized and detailed in 1995 with the adoption of the European Data Protection Directive (95/46/EC). Then the right evolved into its current form in 2016 with the adoption of the General Data Protection Regulation (GDPR)⁽⁷⁾.

Even though Türkiye had signed the European Council Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data in 1981, no action had been taken on this matter until 2010⁽⁸⁾. The right to protection of personal data was recognized in 2010 with the amendment made in Article 20 of the Turkish Constitution, which regulates the right to privacy. During the European Union candidacy process, to meet the harmonization requirements⁽⁹⁾, Türkiye adopted the EU’s then-current regulation on personal data protection, namely the European Convention for the Protection of Individuals about Automatic Processing of Personal Data (Convention no. 108) dated 1981. Thus, Türkiye enacted the Turkish Law on Protection of Personal Data (Turkish Law no. 6698/ KVKK) in 2016, just before the GDPR was adopted in the EU. However, amendments to the KVKK were made in 2024 to comply with the GDPR. Although both regulations are similar on fundamental issues, it is impossible to say that there are no differences.

As retrospective studies are based on patients’ personal health data, they raise questions regarding legal regulations on the protection of personal data⁽¹⁰⁾. While personal health data are regulated under the special category of personal data in both regulations these data require special protection such as explicit consent of the data subject for processing. However, health data must be used in accordance with the purpose explained to the patient when obtaining consent to collect their health data. In retrospective studies, as we mentioned earlier, stored health data are used. That means many of these records were collected years ago, maybe even before the regulations came into force, and there might be no way to reach the patient to obtain their consent for the usage of their personal health data, which was collected maybe decades ago. In the following sections of this study, we will address these issues in depth.

Legal Framework of Pediatric Health Data Protection

Legal Characteristics of Children’s Personal Health Data

Even though there are no specific regulations in either domestic (KVKK) or international law (GDPR) regarding the protection of children’s personal data, both regulations include special provisions for the protection of health data. Both regulations recognize health data as a special category of personal data. That means processing health data requires specific conditions, and these data must be protected more strictly. If one of these specific conditions is not met, personal health data cannot be processed. These specific conditions regulated in KVVK are explicit consent of the data subject, expressly provided for by the laws, necessity for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid, processing of personal data of the parties of a contract is necessary, necessity for compliance with legal obligation, data have been made public by data subject, necessity for protection of any right, necessity for the legitimate interests pursued by the data controller. However, the special conditions regulated by the GDPR are not that different from those in the KVKK.

When it comes to children’s health data, the main focus is on who has the authority to give consent to its processing. In many legal systems as it is in Türkiye, children cannot take legal action by themselves. So their parents have legal authority to act on behalf of their children. That is why there are no special regulations regarding legal authority to give consent for the children. However, GDPR has a special regulation for the authorization of children at least 16 years old to give consent for the processing of their own personal data. Nevertheless, there are no such exceptions in Turkish law. Nonetheless, parents can access their children’s health data according to Turkish law.

Pre-regulation Characteristics of Collection of Personal Health Data

In 1995, the predecessor to the GDPR, Directive 95/46/EC, recognized personal health data as a special category of personal data. Before that, there was no distinction between personal data and personal health data, and both were generally evaluated under the right to privacy of personal life⁽¹¹⁾. There is no difference in the pre-regulation period of Turkish law, too. However, health data were collected in accordance with the legal requirements for creating patient records and stored in accordance with the archiving regulations during the pre-regulation period of Turkish law. Nevertheless, there have been some personal data protection crimes regulated in the Turkish Penal Code, such as recording of personal data, illegally obtaining or disclosing data, failure to destroy data, violation of privacy, violation of the confidentiality of communication, and eavesdropping and recording of conversations between people⁽¹²⁾. Besides, when it comes to health data, there are crimes and remedies for violations of the physician’s obligation to keep secrets⁽¹²⁾.

Applicability of Personal Data Regulations to Previously Collected Data

Non-retroactivity of laws is one of the main principles of Turkish law. This principle is a requirement for legal certainty⁽¹³⁾. However, both KVKK and GDPR do not tend to evaluate pre-regulation data as an acquired right. KVKK has a transitional provision about this matter. According to KVKK’s temporary article 1: “Personal data that is processed before the date of publication of this Law shall be rendered compliant within two years following the date of publication of this Law. Personal data that is determined to be contrary to the provisions of this Law shall be immediately deleted, destroyed, or anonymized. However, the consents that are lawfully obtained before the date of publication of this Law shall be deemed lawful in terms of this Law, provided that no declaration of intention to the contrary is made within one year.” On the other hand, GDPR has no transitional provision on this matter, but among the recitals, there is a similar provision as “Processing already underway on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force.” Where processing is based on consent pursuant to Directive 95/46/EC, the data subject doesn’t need to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation, to allow the controller to continue such processing after the date of application of this Regulation. Directive 95/46/EC shared a similar perspective on this matter, but the Directive’s main focus of the adaptation process was on the digitalization of physical data.

When it comes to health data, in the pre-regulation period, these data were collected in compliance with the current legal requirements. For example, article 72 of Turkish law no. 1219 regulates a legal requirement for physicians to maintain patients’ records. The Operating Regulations of Inpatient Treatment Institutions of the Turkish Ministry of Health also establish a legal requirement for inpatient treatment institutions to create and store patient files. There are also official instructions from the Ministry of Health on the archival obligations of healthcare institutions. Besides, collecting health data for treatment is also a requirement for the treatment agreement to be performed.

Data Collected Before Personal Data Regulations Without Valid Consent

The main issue with medical retrospective studies is the legitimacy of pre-regulation-collected health data. The main cause of this problem is that data was collected for treatment purposes and not for research. Besides, these data might be collected without consent under the circumstances of that day. In this section, we will address this issue while using the “legacy data” term in a legal context, and we will discuss relevant issues such as re-contacting data subjects for consent, purpose limitation, use of personal health data, and the legal bases for ongoing data processing.

Legal Status of Legacy Data

The term “Legacy Data” may have different meanings across various disciplines⁽¹⁴⁾. The main definition of the term is the data collected from disused information systems. In the legal context, we can define the term as the data collected before regulations about personal data protection, even before the protection of personal data was recognized as a right, or briefly, data collected in the pre-regulation period. Today, these data are generally still stored due to institutions’ legal archiving requirements. However, these data cannot be considered to have been collected in compliance with KVKK because these data were not collected based on the data subject’s explicit consent, as we understand it today in the context of KVKK. Nevertheless, explicit consent is not the primary condition for the legality of processing personal health data. The other relevant conditions are: “If it is expressly provided for by law; if it is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, or the planning, management, and financing of health services, by persons or authorized institutions and organizations who are under an obligation of confidentiality.” Under these conditions, legacy health data can be accepted as compliant with the KVKK. However, this matter must be handled with care. If the retention period specified by the regulation has expired, this data cannot be accepted as lawful. Further, there is also a problem with the limited purpose of usage of these data. Because legacy health data were generally collected for the treatment of the patient, they were not collected for academic purposes. So this secondary use would conflict with the KVKK’s limited-purpose usage condition. At this point, Article 28 of KVKK comes to the rescue. This article says that: “Processing of personal data for the purposes of official statistics and, through anonymization, research, planning, statistics, and similar purposes, this Law shall not be applied.” However, for such use, the data must be anonymized.

The Principle of Processing Data for Specific, Explicit, and Legitimate Purposes and the Fitness for Purpose

Both GDPR and KVKK specify the main principles for personal data processing. Both regulations share similar principles, but the GDPR addresses them in greater detail. In this section, we will not address all of these principles but only the principles that are relevant to this section. These are: the principle of processing data for specific, explicit, and legitimate purposes and the principle of processing data to the purpose for which data are collected.

Lack of Explicit Consent

In accordance with the principle of processing data for specific, explicit, and legitimate purposes, personal data cannot be collected for an undefined purpose. That means data controllers cannot collect personal data just in case it might be needed someday⁽¹⁵⁾. That’s why the data controller must determine certain purposes for the data collection and processing, and this specific purpose must be known clearly to the data subject⁽¹⁶⁾. When it comes to anonymized data, there is no issue regarding this obligation. However, non-anonymized data cause huge problems in this context. Hence, Turkish law allows researchers to use anonymized health data in their research. Nevertheless, it is not clear whether Turkish law permits researchers using non-anonymized health data. Because Turkish regulation on this matter explicitly allows the use of anonymized data in research, while there is no regulation regarding non-anonymized data. However, there’s also a provision which allows “Processing of personal data for the purposes of art, history, and literature or science, or within the scope of freedom of expression, provided that national defense, national security, public safety, public order, economic safety, privacy of personal life or personal rights are not violated.” This provision is unclear regarding non-anonymized data. When comparing these two regulations, we can conclude that anonymized health data can be used for scientific research in all cases. In contrast, non-anonymized data can only be used in accordance with the data subject’s fundamental rights. However, this conclusion also raises some questions, such as: “What does usage in accordance with fundamental rights mean?”, “Does this mean usage with informed consent?”. If we must respect the data subject’s fundamental rights, obtaining informed consent may be the right path to follow. However, the Council of Europe recommends that “the law may provide for the processing of health-related data for scientific research without the data subject’s consent.” This recommendation is based on the public interest in the research. However, this recommendation is being criticized in the doctrine as suggesting that even if consent is not required for the processing of its health data for scientific research, the data subject must be granted the right to request that its data be excluded from research⁽¹⁷⁾.

Swiss law permits explicitly researches using non-anonymized data without consent under some conditions, which are: ethics committee approval, research’s precedence over patient confidentiality, impossibility of re-contacting with the patient, patient’s awareness that their data may be used for research, and no objections about it, and maintaining strict confidentiality of the patient’s data. Nevertheless, Swiss law suggests researchers use anonymized data as possible⁽¹⁸⁾.

Processing Limited to the Purpose (Data Minimization)

Principle of processing limited to the purpose or briefly data minimization principle is actually the second branch of the principle of processing data for specific, explicit, and legitimate purposes⁽¹⁹⁾. Because first, the data controller must specify the data collection purpose and this purpose must be legal and then this purpose must be explicitly explained to the data subject. After collecting the data, data controller must process this data in accordance with the collection purpose. This principle has quite importance for both regulations (GDPR and KVKK). However, both regulations also allow the data processing for compatible purposes with the specified collection purpose. Yet, the meaning of the term “compatible purposes” is unclear in both regulations⁽²⁰⁾. Actually this allowance is grounded in practicality⁽¹⁶⁾. Therefore the unclarity of the provision brings its own questions of the application. That’s why some authors have attempted to make this principle understandable by breaking it down into its components⁽²¹⁾.

When it comes to scientific researches, there is an exemption regulated in GDPR as⁽²²⁾: “Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’).” Nevertheless, even though KVKK has not regulated this exception, it has already an exemption provision for scientific researches/purposes.

Ethical Dimension

When it comes to the use of personal health data, compliance with ethical principles is just as important as compliance with legal rules. In this regard, international documents serve as an important reference point. When it comes to ethical principles for medical researches, the main document on this matter is the Declaration of Helsinki of World Medical Association (WMA). This declaration states that ethical principles stated in this document includes “research using identifiable human material or data. “This statement implies that unidentifiable (anonymized) human data is beyond the scope of this declaration. These ethical principles stated in the Declaration as follows: “The primacy of protecting the patient’s health, patient’s dignity and fundamental rights (such as protection of privacy, physical and mental well-being, etc.); generation of knowledge to understand the causes and the impacts of the illnesses and to develop a treatment and prevention methods and to advance human health; lawfulness; sustainability; research capability; protection of vulnerable people/groups/communities; compensation of the damages; proportionality (a research must be conducted if the importance of its impact has outweighs its risks and burdens); compliance with scientific principles; preparation of a detailed research protocol; ethics committee approval; informed consent based on free will; usage of best-practice methods; research registration and publication.”

Another text on this subject is the Belmont Report, which was the result of the topic that drew attention following the Nuremberg trials. This report, emphasizes fundamental ethical principles such as respect for human, beneficence and justice. In addition, the report lists the applications must be done to implement these principles as follows: Informed consent, assessment of risks and benefits and the selection of research subjects.

In addition to the Belmont Report, there are also ethical guidelines for Health-related Research Involving Humans of Council for International Organizations of Medical Sciences in collaboration with the World Health Organization. These guidelines also emphasize general ethical principles on this matter such as; respect for fundamental rights, research’s consistency with the community’s health needs and priorities, equitable distribution, evaluation of potential risks and benefits of the research, choice of control in clinical trials, caring for participants’ health needs, community engagement, collaborative partnership, informed consent, collection, storage and use of biological material and health data, reimbursement and compensation, protection of vulnerable groups, public accountability, establishing research ethical committees. These guidelines support broad informed consent for unspecified future use however, it requires that certain conditions be met as; patient must be informed that its health data can be used in a future research and if the patient has no objection for the future use then researcher can use the patient’s health data in a possible research. Nevertheless, the patient must always be granted the right to withdraw their consent. In addition if these data would be used without consent, then the ethics committee should evaluate the importance of the research and the risks of this situation. Besides, these guidelines allow researchers to use online obtained health-related data too, but under some conditions to be met. First, researcher must contact and obtain the informed consent of the data subject, if it is impossible to access to the data subject then the researcher must obtain the permission of the owner of the online platform. Additionally, researcher must ensure the privacy protection and take measures to prevent the data from being linked to an individual. Finally, the researcher must provide a detailed explanation in the research protocol of how these data will be used and how risks will be managed. These guidelines also address the topic of research involving children and adolescents. According to these guidelines, research involving children and adolescents require the consent of their parents. If  the child reach the legal age of maturity, then the child’s consent must also be obtained. The researches involving children and adolescents should be conducted only if it will benefit them. Otherwise, the research should primarily focus on adults.

Ethical Justification for Using Legacy Data

According to these international documents which set ethical principles for medical researches, there is no ethical problem for anonymized data to be used in the studies whether it is consented or not. However, the problems arise on using non-anonymized data. When it comes to multicenter retrospective studies, the issue of transfer of patient’s data to a third party without the patient’s knowledge arise. Thus, respect for fundamental rights and autonomy principles would be infringed⁽¹⁾. Even if the contact info of the patient’s would be shared with the third parties for the purpose of obtaining consent, it would also be an infringement on the respect for privacy⁽¹⁸⁾.

At this point, it is up to the ethics committee to evaluate the ethical conditions are met in this situation. First of all, evaluation of the importance of this study and its benefits given the risks involved must be considered by the ethics committee. The broader consent option must be also considered, that means if the possibility of the future usage of the health data had been told to the patient in that time and the patient had not objected to this situation. These are the acceptable conditions under these ethical principles. However, when it comes to protection of privacy, especially for the multi central studies, re-contacting with the patient option must be seriously considered. If it is impossible to re-contacting with the patient, for example if the patient is deceased in the time of study, then ethics committee shall give authorization which would be considered as “substituted consent”⁽¹⁸⁾.  Otherwise, avoidance of the contacting the patient on the assumption that they would not consent is not an acceptable situation under ethical principles⁽¹⁸⁾ and the ethical committee should not accept this occasion. Nevertheless, to avoid encountering such  difficult-to-resolve situations, the use of anonymized data should always be prioritized and encouraged.

Role of Ethics Committees in Retrospective Studies

The origin of the concept of an ethics committee, as we know it today, attributed to the Declaration of Helsinki. According to the declaration, research protocol must be submitted to a transparent, independent and competent research ethics committee for an approval. Apart from the Declaration of Helsinki, there is Directive 2001/20/EC of the European Parliament which took its final form in the light of the Helsinki Declaration. This directive includes the official definition of the ‘ethics committee’ as “An independent body in a Member State, consisting of healthcare professionals and non-medical members, whose responsibility it is to protect the rights, safety and wellbeing of human subjects involved in a trial and to provide public assurance of that protection, by, among other things, expressing an opinion on the trial protocol, the suitability of the investigators and the adequacy of facilities, and on the methods and documents to be used to inform trial subjects and obtain their informed consent.” Further, the ethics committee’s core mission is described as outweighing the risks and anticipated benefits in the following provisions of the directive and also the evaluation of the ethical breaches can be rise during the research⁽¹⁾. Besides, the directive regulates that a clinical trial can only be initiated with the approval of the ethics committee.

In Türkiye, as a general regulation on ethics committee, there is a Regulation on Clinical Trials. However the retrospective studies are excluded from this regulation and this regulation, regulates ethics committees for interventional clinical trials (including drugs, bioequivalance and other interventional clinical trials). There are non-interventional ethics committees for non-interventional studies, especially for observational studies in Türkiye⁽²³⁾. There is also a regulation about non-interventional studies under the name of “Regulation on Clinical Research on Traditional and Complementary Medicine Practices.” According to this regulation, the scope of this kind of studies are “clinical research of drugs, medicinal and biological products to be conducted on human beings, clinical research on cosmetic products and their raw materials, observational drug studies, medical device clinical research, observational medical device studies, stem cell clinical research, non-interventional clinical research, and traditional and complementary medicine practices.” This regulation specifies the core duty of the non-interventional ethics committee as assessing the anticipated benefits and forecasted risks of the submitted researches and also the compliance of the research with ethical principles. This regulation have a special provision for the studies on children and according to this provision, ethical committee cannot evaluate the research on children without the positive opinion of a pediatrician or a child psychiatrist on the submitted research and without the informed consent of parents of the children and additionally of the children if the children is capable of giving consent. However, the children must be informed about the research too. There is also a prohibition on persuasive incentive or financial offer to ensure the child’s participation to the study. Among the general principles of the research regulated in this regulation, there is a principle of publishing only anonymized results of the study.

Suggestions for Legal Compliance of the Usage of Unconsented Legacy Data

When it comes to unconsented legacy data, the usage of anonymized data should always be preferred. While the term anonymization means to remove identifying information from the data⁽²⁴⁾ and to make the data unidentifiable by all means, the researcher must ensure that the anonymized data cannot be linked to a real person under no circumstances and must take all necessary measures in this regard. However it is worth noting that while AI systems use big data to work, even if the data has been anonymized, there is still a risk that could be link to a real person by matching with other data in the big data^{(25, 26)}. So, the researcher makes sure that the anonymized data must be unidentifiable with the real people by all means and must choose a reliable anonymization method for that reason. Additionally, the researcher whose study would include AI technologies, ensure that preferred AI technology might not be able to identify the anonymized data’s data subject. Besides, the researcher must explain the anonymization method and the AI technology would be used in the study in detail in the research protocol that would be submitted to the ethics committee. Even if the usage of the anonymized data is a safe heaven from both a legal and ethical standpoint, the research is still requires the approval of ethics committee. There are some guidelines of the Committee on Publication Ethics based on case studies and according to these guidelines while referring to the WMA’s Declaration of Taipei, all of the researches involving human beings require an ethics committee approval⁽²⁷⁾.

When it comes to the usage of unconsented legacy data non-anonymized, it must be the last resort and under some requirements to be met. In this regard, relevant Swiss regulation for waiver of informed consent for research on non-anonymized data, serves as a useful guide. For a lawful and ethical waiver of informed consent, the study must have significant benefits, as exceeding the patient’s interests for confidentiality, it would be impossible to reach to the patient and this impossibility must be justified in the research protocol, patient must be informed for the future use of its health data in a potential research when the data were collected and the researcher must ensure the protection for the privacy of the data subject. When it comes to multicentral research, contacting the patient has become even more important, since the personal data would be shared with the third parties. In our view, in that situation, whoever collected the data must contact the patient to obtain permission to share with third parties. These suggestions are also applicable from the perspective of Turkish law. While it is unclear that the usage of the non-anonymized and unconsented legacy data is permitted for scientific purposes according to the Turkish law, the relevant regulation prioritizes the protection of privacy and fundamental rights in such situation. It is also important to remember that Turkish law only permits to anonymized publication of the result of the study.

CONCLUSION

Since the retrospective studies are observational studies, they differ from other types of medical research. Furthermore, because they do not include direct intervention with the patient’s body, they are generally considered the least ethically problematic⁽²⁸⁾. So that there are some authors that criticize ethical committees to be too strict to discourage conducting retrospective studies⁽⁵⁾. However, this is a misleading assumption. Because the personal data is among the most valuable assets of a person. It is also relates to the person’s private life. A breach of personal data also constitutes a violation of privacy. Such a situation would also cast a doubt on public confidence in the healthcare system.

While the right to personal data protection was recognized as a right in 1995, it took its current form  following the regulations introduced in 2016. It is worth noting that while there are some important provisions about health data, there is no special provision on children’s data. Since the health data is regulated as special category of personal data under these regulations, protection of health data requires special protection and special conditions to be processed. While processing the health data is subject to strict rules, regulation allows to the usage of the health data in scientific studies. However, while the usage of the anonymized health data in the scientific researches is allowed clearly, there is a lack of clarity in the use of non-anonymized health data in the scientific research. Nevertheless, the regulations prioritize the data subjects’ fundamental rights regarding their personal data.

When it comes to legacy data, there is no doubt that the data can be used in retrospective studies as long as the data anonymized. On the other hand, while there is lack of clarity in the usage of the non-anonymized and unconsented legacy health data, there are some ethical principles and some regulations of other countries that might be the guide on this matter. Upon examining these, the following examinations can be drawn: The research must have a significant importance in the light of the risks it poses to the individual’s rights; it must be impossible to re-contact to the patient to obtain its consent⁽¹⁾ and it must be justified in the research protocol; while collecting the data, the patient must be informed about the possibility of the future use of their data in scientific purposes, and there should be no objection to this; and there must be the ethics committee approval, which serves as a substituted consent. Besides, it is important to note that if the child had reached the legal maturity age by the time the study was conducted, then the parents’ consent is not enough. However, the use of the anonymized data should be the priority, while the use of non-anonymized data should be a last resort. Finally, it should not be forgotten that Turkish law does not allow non-anonymized data to be published as the result of a scientific research.