Consent for use of personal data

Require that consent or comparable legal basis be sought consistently for all collections of sensitive human subject data and metadata, including personal data, and that any use be in conformity with the consent granted, applicable privacy regulations, and ethical principles.

Where it is proposed that personal data be used in ways not initially foreseen in the consent granted and seeking consent for such new use is impractical, specific case-by-case arbitration implemented by ethics review boards or similar authorities may be appropriate.

Such case-by-case arbitration should also be accompanied by a review taking into account legal aspects of the planned change of purpose.

Implementing the provision of informed consent for the use of personal data includes:

• Developing clear guidelines on obtaining consent for the collection and use of sensitive personal data, including templates for consent forms, Data Protection Impact Assessments (DPIAs), and implementation of Technical and Organizational Measures (TOMs).  

• Providing dedicated support resources or advisory services for researchers to tackle informed consent requirements.

• Mandate ethics review board oversight for cases where new uses of personal data are proposed that were not covered by the original consent. Such reviews should consider legal, ethical, and regulatory aspects.

• Require research calls and tenders to include provisions for informed consent and adherence to applicable data protection laws, ensuring compliance from the project design phase.

Risks and hurdles in implementing this provision include:

• The complexity in drafting consent forms that align with legal, ethical, and project-specific requirements challenges researchers. 

• Unforeseen future uses of data may necessitate case-by-case arbitration, which can be resource-intensive and slow. 

• Limited understanding among researchers of legal frameworks across jurisdictions (e.g., General Data Protection Regulations (GDPR) in the EU, Health Insurance Portability and Accountability Act (HIPAA) in the US) and ethical principles may result in non-compliance. 

• Ensuring consent mechanisms are consistently applied across diverse projects and institutions can create logistical challenges (e.g. research projects that operate across borders or different disciplines, methodologies, and data types, may find it difficult to develop a single, standardised informed consent framework).

• Re-contacting participants for updated consent in cases of unforeseen data use is often impractical, particularly in large-scale or long-term studies, requiring robust ethical oversight mechanisms.