Global Alliance for Genomics and Health: Data Privacy and Security Policy
First the original version and then the exploded version:

1. Consent and other lawful bases
   
   • Data should be used strictly in accordance with the data subject’s (or their legal representative’s) consent for processing, and/or the terms and conditions of authorization for lawful processing by competent bodies or institutions (e.g. terms and conditions set by research ethics committees, waivers of consent), and in compliance with international and national laws (including tribal, indigenous, and aboriginal laws), regulations, general ethical principles, and best practice standards that respect conditions on downstream uses of the data.
2. Consent and other lawful bases
   Data should be used strictly in accordance with
   1. the data subject’s (or their legal representative’s) consent for processing, and/or
   2. the terms and conditions of authorization for lawful processing by competent bodies or institutions (e.g. terms and conditions set by research ethics committees, waivers of consent), and
   3. in compliance with
      1. international and national laws (including tribal, indigenous, and aboriginal laws),
      2. regulations,
      3. general ethical principles, and
      4. best practice standards that respect conditions on downstream uses of the data.