Consent is one of the most commonly used legal basis for data processing for research projects. As the use of consent is often misundeerstood, we will discuss here in more detail what needs to be done to ensure consent is legitimately used in a research project. Keep in mind that all projects at the Geosciences Faculty that process personal data must demonstrate compliance with the GDPR by performing a Privacy Scan, where the proper compliance with consent requirements will be thoroughly documented.

What needs to be done to ensure consent is legitimate?

To get a better understanding of consent under the GDPR, let’s first look at the definition laid out in Article 4(11):

‘Consent’ of the data subject (user) means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

The bolded words above are key to ensuring that consent is lawfully obtained, but what exactly do they mean?

Let’s break down these terms into something more understandable:

• Freely given: Individuals must be presented with an actual choice and not coerced by negative consequences.
• Specific: The requirement that consent be ‘specific’ aims to ensure a degree of user control and transparency for the individual. Consent thus should only be given to specific actions instead of a broad consent to the use of data – although Recital 33 recognizes that broad consent may be appropiate for some scientific research purposes, as discussed below
• Informed: Individuals must understand the full scope of data collection and its use before making the decision to consent. It should be made clear that consent is being requested, and for what specific purposes.
• Unambiguous: It needs to be made obvious that the user is giving their consent.
• Affirmative action: Users must take an action to demonstrate their consent to the processing of their data. In practical terms, if an unchecked box is presented to participants, ticking the box would then be considered an affirmative action.

If your project complies with all of the above, you have correctly applied informed consent. We will now discuss in detail the requirements listed above.

Assessing if consent is freely given

The element “free” implies real choice and control for data subjects. To be truly freely given, individuals must have real choice, should not feel compelled to give consent and should endure no negative consequences if they do not give (or withdraw) their consent. In general terms, any element of inappropriate pressure or influence upon individuals (which may be manifested in many ways) which prevents a data subject from exercising their free will, shall render the consent invalid.

Consent can only be valid if the data subject is able to exercise a real choice, and there is no risk of deception, intimidation, coercion or significant negative consequences (e.g. substantial extra costs) if they do not consent. Consent will not be free in cases where there is any element of compulsion, pressure or inability to exercise free will. When there is a clear imbalance of power between researchers and data subjects (for example, when data subjects are students, or are employees of the research controllers), they will likely have no realistic alternatives to accepting the request of the researcher. Given the dependency that results from the employer/employee relationship, it is unlikely that data subjects are able to deny their employer consent to data processing without experiencing the fear or real risk of detrimental effects as a consequence of their refusal.

Assessing if Consent is Specific

A project may involve multiple processing operations with several purposes. In such cases, data subjects should be free to choose which purpose they accept, rather than having to consent to a bundle of processing purposes. In a given case, asking consent for each separate processing purpose may be warranted.

You should provide specific information with each separate consent request about the purpose of each data processing, in order to make data subjects aware of the impact of their different choices. Thus, specific information is necessary to enable data subjects to give specific consent.

Sometimes in research it is not possible to fully identify all possible future uses of collected data. In those cases, consent would remain valid if researchers can ensure data subjects are kept informed and are able to exercise their rights at a later stage. For example, by continuously updating the project information website so that individuals are kept informed of how their data is being used, long after they gave their consent. When research purposes cannot be fully specified, controllers would be expected to do more to ensure the essence of the data subject rights to valid consent are served, including through as much transparency as possible and other safeguards.

Assessing if Consent is Informed

Providing information prior to obtaining data subject’s consent is essential in order to enable them to make informed decisions, understand what they are agreeing to, and to enable the exercise of their right to withdraw their consent. If the controller does not provide accessible information, data subject control becomes illusory, and consent will be an invalid basis for processing.

How to provide information: The GDPR does not prescribe the form or shape in which information must be provided in order to fulfil the requirement of informed consent. Valid information may be presented in various ways, such as written or oral statements, or audio or video messages – as deemed appropriate given the context of the processing and data subject.

The provided information should enable data subjects to easily identify who is processing their data (the controller) and to understand what they are agreeing to. Therefore, the information must use clear and plain language in all cases. The information should be easily understandable for the average idnvidual and not only for researchers or other specialists.

Providing information using a layered and granular approach can be an appropriate way to deal with the two-fold obligation of being precise and complete on the one hand and understandable on the other hand. This means you can provide clear and concise information upfront (the first layer, offering minimal, indispensable information), and provide additional information (second layer, offering more granular information) somewhere else – for example, using a “please click here to learn more about how we handle your data” link. This additional information can take the form of an attached extra pages, a link to the project website, a collapsible paragraph within the main text, or any other source that will make the information easily available to participants. Nevertheless, if your project is simple enough that you can explain it fully upfront, you will likely not need to provide an extra layer of information.

What information needs to be provided?

You should consult step 5 of the Privacy Scan guidance, where it is explained in more detail what and how to provide information to data subjects.

Assessing if Consent is Unambiguous and an Affirmative Action

The GDPR is clear that consent requires a statement from the data subject, or a clear affirmative act, which means that it must always be given through an active motion or declaration. It must be obvious that the data subject has consented to the particular processing.

Consent can be orally recorded: A “clear affirmative act” means that the data subject must have taken a deliberate action to consent to the particular processing. Consent can be collected through a written or (a recorded) oral statement, including by electronic means.

The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice. In the context of a survey, assuming that consent has been given by asking data subjects to click on the “next page” or “continue” button is inappropriate. By actively ticking the optional box stating, “I consent”, the individual is able to validly perform a clear affirmative act to consent to the processing.

To sign or not to sign: Signatures in consent forms for research are rarely needed. If the identity of the individuals is supposed to be recorded and used in the process (as it happens during clinical trials, where the identity of the data subject is likely to be known to controllers/auditors as required) then asking to provide a signature is a good practice, since it will not lead to having additional information – the identity of the data subject is already known to controllers – and the signature authenticity can readily be checked at any time, since controllers already know who is behind the signature.

On the other hand, if your research process is not using real names, or is using a pseudonym unconnected to individual’s real names, using a signature would lead to the unnecessary processing of personal data.

A signature is not necessary to remind individuals of their own choice – regardless of if they sign or not, they can change their mind as they please. Using a signature to demonstrate consent to a third party is also useless if there is no way to match the given signature to the person giving it – there is no way to prove it is authentic, because it not supposed to be known who is behind that signature. Therefore, having a signature is usually unnecessary. A check box (and possibly a statement/signature of the person/researcher who collected the consent) should be enough. In addition, in order to be able to link a consent form with its respective data subject, you should include the data subject pseudonym in the consent form – the identifier that you will use to track the individual’s data within your research project (like Participant B-42).

Obtaining explicit consent. The GDPR prescribes that a “statement or clear affirmative action” is a prerequisite for ‘regular’ consent. The term explicit refers to the way consent is expressed by the data subject. It means that the data subject must give an explicit statement of consent. An obvious way to make sure consent is explicit would be to expressly confirm consent in a written statement. If the individual identity is recorded in the research, you could make sure the written statement is signed by the data subject, in order to remove all possible doubts and potential lack of evidence in the future. However, such a signed statement is not the only way to obtain explicit consent. For example, individuals may be able to issue the required statement by filling in an electronic form, or by sending an email. Two stage verification of consent can also be a way to make sure explicit consent is valid.

As long as a data processing activity in question exists, the obligation to demonstrate consent remains. After the processing activity ends, proof of consent should be also deleted and should not be kept for longer than strictly necessary for compliance with a legal obligation or for the establishment, exercise or defense of legal claims. In most cases for research projects, proof of consent (especially if it contains personal information like names and/or signatures) should be deleted once the project is completed. However, proof of consent should still be kept if (deidentified) personal data is going to be kept archived – and not deleted.

If your project lasts for a considerable amount of time, The EDPB recommends as a best practice that consent should be refreshed at appropriate intervals. Providing all the information again helps to ensure the data subject remains well informed about how their data is being used and how to exercise their rights. A good rule of thumb is to refresh consent every year or two.

Discussion: Consent of human participants in research and consent of data subjects

There is a clear overlap between informed consent of human participants in research projects involving humans and consent under data protection law. But to view them as a single and indivisible requirement would be simplistic and misleading. Consent serves not only as a possible legal basis for the activity, it can also be considered as a safeguard – a means for giving individuals more control and choice and thereby for upholding society’s trust in science.

Informed consent responds primarily to core ethical requirements of research projects involving humans deriving from the Helsinki Declaration. For example, the obligation to obtain the informed consent of participants in a clinical trial is primarily a measure to ensure the protection of the right to human dignity and the right to integrity of individuals under Article 1 and 3 of the Charter of Fundamental Rights of the EU; it is not conceived as an instrument for data protection compliance.

There may be circumstances (for example, in clinical trials) in which consent is not the most suitable legal basis for data processing, and other lawful grounds (from GDPR Art 6) should be considered. In particular where there is a clear imbalance of power that would imply consent was not ‘freely given‘ in the meaning of the GDPR.

However, even where consent is not appropriate as a legal basis under GDPR, informed consent as a human research participant could still serve as an ‘appropriate safeguard’ of the rights of the data subject. Under what conditions such informed consent might be deemed an appropriate safeguard is still unclear. Certainly, innovative forms of consent in research activities, like tiered and dynamic consent, are promising practices that should be further encouraged and developed.

For the time being, in those circumstances in which consent is not used as legal basis, it may be still advisable to still ask participants their informed consent to participate in human research projects. Further guidance is found in the Preliminary Opinion on data protection and scientific research.