Consent aims at informing potential study subjects of all aspects of participation, including the procedures for data handling, data access and anonymity. An informed person can freely decide to participate or not. If someone does participate, he or she understands and accepts the risks and burdens involved in participation.
The Central Committee on Research Involving Human Subjects (CCMO) has produced guidelines for obtaining informed consent and has adapted the nationally mandatory proefpersonen-informatieformulier in light of the GDPR (for WMO research). In addition, the NFU working group ‘Privacy, ethiek & recht in gezondheidsonderzoek’ is currently developing a UMC format for broad consent, which may be applicable to certain non-WMO research.
The ethical committee at your UMC can help you design your informed consent procedure. Regarding data management, the informed consent should include the person's wishes about:
Consent should be documented along with the collected data, so subsequent users of the data are aware of the conditions agreed to by study subjects.
In general, it is very difficult to re-contact patients or study subjects to extend or change the consent. So, we advise you to obtain informed consent for storing clinical and personal data for the purpose of both healthcare and future scientific research, each with a separate specific informed consent (also see: care and research environment). In addition, patients should always be able to retract their consent.
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
And, regarding broad consent for scientific research: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”
In some exceptional cases, you are legally allowed to perform scientific research without a consent. Always minimise the data and specifically describe the arguments for not asking for consent and make sure that your institute or its Data Protection Officer has accepted your arguments, before you start your research.
Informed consent is not mandatory if your data is truly anonymous. However, you should carefully consider whether your data indeed is anonymous: it may be possible to trace ‘anonymous’ data to an individual person by combining the data with other data sources. You should always be aware of this possibility when sharing your data with third parties. It is advisable to let an independent party (for instance a Data Access Committee or Board) objectively assess your proposed data sharing.
Your institute needs to actively inform patients that they may be asked to participate in scientific research. Also, they should be informed that in some exceptional cases, it can legally be allowed to perform scientific research without a consent. Patients are offered the right to refuse to such use. Your institute needs to install a procedure to ensure that such refusals are followed through, i.e., if people have refused sharing their data for scientific research, these data should not be used in research.
The EU General Data Protection Regulation states that ‘Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.’
Most genetic studies will involve restricted access to individual level genotype and phenotype due to privacy concerns that are associated with this type of data.
For more information on incidental findings, please take a look at the BBMRI publication: Handreiking voor het constateren van, omgaan met en informeren over nevenbevindingen voor biobanken in BBMRI-NL.