Summary: Asking data subjects for their input regarding the processing of their personal data, is a useful way to ensure the processing is designed in a balanced and fair manner – especially useful for (research and non-research) activities that involve controversial topics, or process data in unexpected ways. But even if a research project is unable to consult data subjects beforehand, their rights and interests can still be safeguarded by conducting an ethics assessment.

When a controller is planning to process personal data, it is often necessary to ask data subjects for their input: Do they agree with the controllers that the necessity and proportionality of the processing is indeed properly justified? What are their views on the planned processing? Incorporating their feedback in the planning stage can lead to a more balanced and fair processing, and likely reduce potential objections, challenges or consent refusals once the processing is started.

In other words, consulting data subjects to obtain their views on the processing empowers them to exert their influence on the process during the design stage, as incorporating their feedback into the project’s design contributes to ensure their rights and interests are respected from the start of the processing. This consultation is still useful even if data subjects do not put forward their views, as communicating controller’s interests and intentions is also an instrument of transparency.

The nature of the processing determines the usefulness of the consultation. Seeking data subject’s views on processing activities that involve controversial topics, or process data in unexpected ways, are more likely to yield useful feedback and improvements in the design of the processing activity.

Data subject’s views can take different forms: They can come directly from data subjects themselves, or from a representative group; they can be derived from a previous activity, survey or study output; or perhaps the processing itself was kickstarted by a data subject’s request. Any influence, feedback or involvement that data subjects may have in the creation, formation or design of the processing activity, is worth mentioning in Step 10.

Nevertheless, for some processing activities, it is either not feasible to gather the views of data subjects, as doing so would require a disproportionate effort, or it is not possible to reach out to data subjects before the start of the project (as is the case with many research projects where data subjects can’t be contacted because their identity is not known beforehand), or simply because doing so would be unlikely to yield meaningful improvements on the processing design – because the project involves uncontroversial and reasonable expected processing activities, like organizing a meeting, or managing a survey.

In particular for research projects where it is not possible to gather the views of data subjects, an ethical assessment can still ensure that the interest of data subjects are adequately observed and safeguarded. In those cases, it should be stated in the privacy scan that “The data subjects’ views and interests are considered and safeguarded by conducting an ethical assessment of the project”

Previous: Description of Planned Transfers of Personal Data to Other Countries Outside the EU | Next: Preliminary Risk Assessment