Research-ethical consent and data protection in research
Research-ethical consent and data protection in research
Research-Ethical Consent – What, Why and When?
Research-ethical consent means that people who participate in a research project voluntarily agree to participate on an informed basis.
This means that research participants understand the purpose of the research, know what their participation involves, have been informed about any risks and disadvantages, and are aware that they can withdraw without negative consequences.
Why is consent important?
Consent is a central principle of research ethics because it protects participants’ autonomy, dignity and rights. Participants must have the opportunity to make a genuine and informed decision about whether they wish to take part.
When is consent required?
As a general rule, research-ethical consent is required when the research involves people directly, includes intervention, observation or interaction, or uses information that participants may reasonably perceive as sensitive.
Comprehensive participant information
Even when consent is obtained orally, or where participation may be assumed in the specific situation, it is essential that participants have received comprehensive information. It is the information provided, rather than the form of consent, that ensures participants genuinely understand what they are agreeing to.
Research-ethical consent and GDPR – Not the same thing
It is important to distinguish between research-ethical consent, which relates to research ethics, and permission under data protection legislation to process personal data (“GDPR legal basis”).
Research-ethical consent concerns whether it is ethically justifiable to involve people in research, whereas a GDPR legal basis concerns when and how personal data may be processed lawfully.
Find templates to the consent form here
Legal Basis under the GDPR in Research
In a research context, there are typically two relevant legal bases: data protection consent under data protection legislation (“data protection consent”) and the research legal basis. In most research projects, the research legal basis is recommended.
Why is the research legal basis recommended rather than data protection consent?
In many research projects, it is recommended to use the research legal basis rather than data protection consent. This is primarily because the research legal basis better reflects the nature of research, cannot be withdrawn in the same way as data protection consent, and provides a more stable basis over time.
In addition, data protection consent may give research participants a misleading impression of their rights. If the processing of personal data is based on data protection consent, research participants will typically expect their personal data to be deleted if they withdraw their consent. In research, however, exceptions to the right to erasure may apply, meaning that data may continue to be stored and used even if consent is withdrawn.
Furthermore, data protection consent may limit the future use of data. As a general rule, processing may only take place for the purposes described in the consent. This may make it difficult to use the data later for new and relevant research questions.
A more accurate solution will therefore often be to combine:
research-ethical consent to participate in the research; and
the research legal basis as the legal basis for the processing of personal data.
You can find a template or inspiration for this combination here. (LINK)
When should or must data protection consent be used?
Although the research legal basis is, in many cases, the most appropriate legal basis for processing, there may be situations where data protection consent should or must be used.
Data protection consent is relevant when personal data are to be shared with parties who use the data for purposes other than research, as the research legal basis is limited to use in research.
Data protection consent should also be considered if sensitive personal data form part of the publication of research results and cannot be sufficiently anonymised.
Finally, consent may be necessary if no other legal basis for processing applies.
Where data protection consent is used, it must comply with the requirements of the GDPR. You can find a template or inspiration for the combination of research-ethical consent and data protection consent here. (LINK)
Need Help?
You are always welcome to reach out to us for assistance.
Contact the Research Ethics Committee Secretariat
If you experience technical issues, please contact IT Support
Privacy policy
Læs mere om vores privatlivspolitik.