Transparency
The lawfulness, fairness and transparency principle of GDPR requires data subjects to be provided with certain information about the collection and processing of their personal data. This information is typically provided in the form of ‘fair processing notices’ or ‘privacy notices’. In a research context, this information may often be included within a patient information sheet or similar document which is provided to support informed consent, though it can be provided separately.
The GDPR require the information to be provided to data subjects in a concise, transparent, intelligible and easily accessible form and to be written in clear and plain language (in particular where directed to a child).
Fair Processing Information
The following information always needs to be provided to individuals whose personal data is being used:
Lawful Basis
There are six different legal justifications for processing identifiable information; 'consent' is one of them but, perhaps counter-intuitively, researchers should not generally use this as their legal basis. This is, in part, due to a data subject's right to withdraw consent at any time.
The University Charter gives it, and its researchers, the power to “make provision for research and for the advancement and dissemination of knowledge”, and this provides our legal basis for the processing of data for research purposes. We would therefore generally expect researchers to stipulate the legal basis for processing data as ‘public task’.
This does not in any way alter the requirement to seek consent for participation in research:
“It is important not to confuse consent sought for other purposes, e.g. an ethical or common law requirement, with the lawful basis for processing under data protection legislation. The lawful basis for processing under data protection law may be something other than consent with consent still sought for participation in the research.
For example, an individual is asked if they will agree to participate in research but is told that, if they agree to participate, then the processing of his or her personal data will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority.”
From A Lawful Basis for Health Research under Data Protection Law.
Where the processing of personal data is undertaken in reliance upon the public task condition, the right to erasure (‘right to be forgotten’) and right to data portability do not apply. However, data subjects still have other rights in relation to the processing of their personal data.
It must be noted, that any processing of personal data must be “necessary”. If it would be possible to undertake research in a less intrusive way, then the University may not be able to rely upon the public task condition. This might be identified during REC review or as the result of a complaint to the ICO.
Relying upon the public task condition for the processing of personal data does not provide justification for the disclosure of confidential patient information in the public interest.
Recommended Wording for Participant Information – Clinical Research
For any trial that requires approval by an NHS REC, the wording below should be included in the patient information sheet.
Delete as appropriate anything in square brackets and any section preceded by OPTION. Replace as required any bold and italicised text with appropriate specific examples.
-----------
How will we use information about you?
We will need to use information from [you] [from your medical records] [your GP] [OTHER] for this research project.
This information will include your [initials/ NHS number/ name/ contact details/ a bullet list of identifiers held by site and/or sponsor for the research]. People will use this information to do the research or to check your records to make sure that the research is being done properly.
OPTION where applicable: People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead.
We will keep all information about you safe and secure.
OPTION where applicable: Some of your information will be sent to country X. They must follow our rules about keeping your information safe.
Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study.
What are your choices about how your information is used?
Where can you find out more about how your information is used?
You can find out more about how we use your information:
----------
Recommended Wording for Participant Information – All Other Research
How will we use information about you?
We will need to use information that you provide about yourself for this research project.
This information will include your [initials/ name/ contact details/ provide a bullet list of identifiers held by site and/or sponsor for the research]. People will use this information to do the research or to make sure that the research is being done properly.
OPTION where applicable: People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead.
We will keep all information about you safe and secure.
OPTION where applicable: Some of your information will be sent to country X. They must follow our rules about keeping your information safe.
Once we have finished the study, we will keep some of the data so we can check the results. Once the data has been analysed, we will seek to share our findings through publication, presentation and the media. All reports will be written in a way that ensures that no-one can work out that you took part in the study.
What are your choices about how your information is used?
Where can you find out more about how your information is used?
You can find out more about how we use your information:
