 Hi, everyone. Thank you for joining us today. My name is Hina and I'm the Senior Research Data Officer at UK Data Archive. We are based at University of Essex and I am in the Research Data Management Team. My main responsibility is to oversee the guidance and training of ethical and legal aspects of data sharing. Before we begin, just a couple of questions. If you can go to menti.com and using this code, you can use the Mentimeter on your mobile phone, keep it on because I will be using these menti questions throughout my presentation. So it's a quick introduction to your background. For example, if you are a post grad early career researcher or professional services staff, if you would like to share with us, statistician, PhD students, fellow researcher, clinical researcher, government, post grad student. So we have a veterinary surgeon. That's interesting. Research fellow, research ethics integrity, library and data manager. It's quite interesting that we have a mix of people here today. Postdoc researcher, data governments, manager and PhD students, senior data manager, data manager. That's great. Lecturer, MPHIL student, early career researcher. So that's great. We have a mix of people from diverse backgrounds. Service development, evaluation lead. Thank you. That's great. So can I ask what type of data are you working with? Just to see. The mix majority is working on mixed data. That's excellent. Some of you are into qualitative and someone is in quant. So that's great to see that we have a mix people here coming from diverse backgrounds working on different types of data. So I'll be covering both corn, coal in today's session, and I hope that it will be useful for you. Thank you very much for your responses. So the overall aim of this session is to show you the role of informed consent in sharing data within ethical and legal boundaries. And I aim to cover the following in this session. For example, in the first section, I'll talk you through why to seek consent and this section will focus on introducing the use of informed consent in research. And the second part of the session is about how consent can be obtained, covering documentation and methods that are used to obtain consent. And finally, how to manage the obtained consent forms. And this is then followed by a section on when consent could be sought during the research process. Some of the important aspects that needs to be considered are also discussed. And final section focuses on sharing with you some of the wordings used in consent forms by the researchers so that it could be helpful for you to see the real examples. Some example consent forms and information sheets. I'll show you those as well. And I'll finish it off by highlighting some best practice tips and resources that can be very useful if you are interested in data sharing. And I'll respond to your questions in the end if you can type in your question in the Q&A box, that would be helpful. So, as I mentioned earlier, the first section is about why we seek consent. So, again, time for Mentimeter, what do you think why we seek consent? Any thoughts? Just a quick one. Because, sorry, when I was doing my PhD research, the only thought about getting informed consent is the ethical context, asking researchers for sorry, participants for research participation. That was my only thought at that time. Yeah. So, to enable the sharing of data that's right, transparency, comply with legal requirements, GDPR, that's correct to ensure people know how their data is being used, correct, respect for autonomy. That's right, legal requirement, GDPR requirement, transparency, ethical considerations, that's right, clear on how their information will be used, correct? That's true. Transparency, dealing with any historical legal issues that's right. Data sharing, patient's rights, future research, ethical issues, to ensure we have approval of participants to share their data. Yes, that's important. To use data research without it, we could not use or share our findings, that's right. Avoiding harm, allow reuse and sharing, that's right. To ensure everyone involved is informed about processes, outputs, data management, that's right. Data sharing, informed consent, GDPR, that's right. So, two purposes, ethical and legal context, we see consent to show adherence to rigor in research, that's right. Yeah. So, thank you very much for your responses, very well informed, because as researchers or PhD students, I think we just put emphasis on consent just to ask participants for research participation. This one aspect was kept in mind at that time, as far as myself is concerned, I'm not sure, but today I think you all are very well informed about the purposes of consent. So, you all are very familiar with what informed consent is. And so, just to give a bit of description, it is the process by which a researcher discloses appropriate information about the research so that a participant may make a voluntary informed choice to accept or refuse to participate in the research. And in the research context, consent is obtained to ensure that participants understand what they are signing up to, making participation and research more effective. And it also ensures that the research conducted is ethical and compliant with the data protection regulation, as you all said. However, in research context, as we have seen with all your responses, we need consent for two purposes, consent for research participation, which is considered as one of the founding principles of research ethics, where it is sought before participation in any research activity and for all participants. And as you are aware that it usually involves providing information regarding study purpose, risk, benefits, voluntary participation, and so on. And however, consent can also be used to comply with the data protection regulation. If a researcher collects, manages and shares personal data, then consent of the data subject can be used as a legal basis to process this personal information under the UK PR. In the UK, there is a duty of confidentiality that is based in common law and that occurs where confidential information comes to the knowledge of a person. In circumstances where it would be unfair if it were then to be disclosed to others. So there are some exceptions when you can disclose information, for example, if participant consents to over-sharing their personal data, then this sharing does not preach duty of confidentiality. And sometimes public interest can override duty of confidentiality as well. And occasionally, there are instances when you may need to give up data such as court order. So the best practice is to avoid very specific promises in consent forms, if you are to share your data. As researchers, we must adhere to data protection requirements as some of you have already mentioned in your responses, especially when managing or sharing personal data. Personal data is any information relating to an identified or identifiable natural person and people can be identified directly or indirectly. Some of the direct identifiers are name, address, postcode, telephone number, voice pictures, and examples of indirect identifiers are occupation, geography, unique or exceptional values or outliers in the data. So if personal information about people is collected or used in research, then the GDPR applies. However, anonymized data, if you anonymize your data, then it is not personal data, so GDPR does not apply on that. If you are 100% sure that it is anonymized. A bit of background to the GDPR is necessary here. GDPR is the EU-wide data protection regulation that was introduced in 2018 and replaced UK Data Protection Act that was used until that time. However, after Brexit, it is now called the UK GDPR and currently UK GDPR and EU GDPR both are aligned and they place the same legal obligations on researchers. But in the future, two pieces of legislation may diverge. So now if the researcher based in the UK collect personal data about people anywhere in the world or a researcher outside the UK collect personal data on UK citizens, then Data Protection Act and UK GDPR applies. However, if the researchers are undertaking research projects which span across the EU, then EU GDPR will also need to be considered. So there is a misconception that data protection laws such as GDPR prohibits data sharing. However, it does not prevent data sharing as long as you approach it in a sensible and proportionate way. In fact, it is useful for research as it legalizes much of the current good practicing research such as data sharing and archiving. So under the UK GDPR, there are six possible grounds for processing personal data and one of these must be present. And as you can see on the slide that these are consent, public interest, legitimate interest, protection of vital interests, legal obligation and performance of a contract. However, in the context of research, the first three ones, consent, public task or legitimate task are the most applicable grounds for the processing of personal data and consent is likely to be the most widely used ground for processing of personal data and I will be focusing on this first ground in today's session. If consent is used as a legal basis for the processing of personal data, keep that in mind that I am talking about consent being used as a legal base, not as a participation in research, the usual ones you use for your data collection. So there are certain conditions that needs to be met if you use consent as a legal base to process personal data and consent must be freely given in form unambiguous, should be spec specific. There should always be a clear affirmative action and should not be inferred from silent speech, ticked boxes or inactivity and it should mention about right to withdraw. Participants can withdraw their consent for processing personal data and remember that this is different from the right to withdraw from the research. So it must be documented. The most important thing is that it must be documented either recorded written or oral but there should be some information somewhere documented. And if you are dealing with special category data then there must be an explicit written statement. So would you like to name the country where you are carrying out your research? Again if you would like to go to the mentee meter for a quick question, UK, Germany, US, global, Canada. So majority of you from the UK but there are people who are doing research in other countries as well. The globally international PTS online. Yeah so you must be aware that there must be different rules in terms of the data protection laws around the world. So apart from being good scientific practice in some countries I have gathered examples not for the US or others here but some of the examples on this slide. Here you can see that some countries have mandatory requirement to obtain consent if you collect personal data. However there is no legislative requirement for consent to be sought from participants in the UK. So I think UK is the exception here among this list of the countries but in the UK funders and research ethic committees and ethics guidance bodies they do require it. So it depends. This next section is about how to see consent and it includes formats to obtain consent including documentation methods and record keeping. So consent can be gained in written or oral form and the format of the consent depends on the kind of research. However it is important that whatever format is being used it should be documented as I said earlier. You need to document how it has been gained, what information has been provided to the participants and what they have agreed to. That's the most important thing. Consent can be written or verbal and both formats have pros and cons. For example written consent has more solid legal ground. For example it can show that participants have agreed to disclose confidential information and this is the form that is usually required by ethic committees and most of all it offers more protection for researchers as they have written evidence of consent. However it cannot be used in some instances such as in illegal activities or so on and on the other hand verbal consents are best if recorded but sometimes it is hard to make all issues clear verbally and most of all it can pose greater risk for researchers in regards to adequately proving participant consent. So or it may scare people from participating and have them think they cannot withdraw their consent in these sorts of concerns. So it's good to have a written one especially if you plan to share your data. Typically you must be aware that written consent documentation includes an information sheet and a consent form signed by the participant because this division allows the background information to be as filled as necessary while keeping the signature form short and concise. And information sheet should cover the following topics you must be aware of these purpose of the research, what is involved in participating, benefits and risk, procedures for withdrawing future uses of data such as storage publishing and archiving and details of the research for example funding source, sponsoring institution, name of the project, content details of the researchers and how to file a complaint, all these usual things. And researchers need to make sure in terms of the consent forms they should use simple language and should allow the participants to clearly respond to points such as they have read and understood information about the project, they have been given the opportunity to ask questions, questions relating to voluntary participation about withdrawing from the project without giving any reasons and future uses of the data. The most important part if you are planning to share your data so and you are collecting personal information then best practice is to provide information about how personal information will be processed and stored and for how long, procedures for maintaining confidentiality, whether real names will be used or not, if data will be anonymized if so, how it will be anonymized, it should also state procedures for ensuring ethical use of data especially in the context of archiving and reuse. And if the GDPR applies then further information needs to be provided in the consent form such as the contact details of the data controller. Data controller is the entity that determines the reason for processing personal data. It could be a data protection officer, a Rio at your organization or a researcher. So consent form should also state will receive or have access to the personal data. It should also have a clear statement on the rights of the participants because participants can request to access their data, they may ask for corrections or even removal of their personal data. So these things need to be communicated to the participants. However, you may use some in the information sheet and some in the consent form, it's entirely up to you. And you can have a look at the UK data service model consent form template where you can find detailed guidance along with all these issues that I have highlighted. I have added a link on the last slide and I will show you the template in the following slides. So different methods can be used to obtain consent if you are processing personal information. And ICO has recommended the following. For example, signing a consent statement on a paper form, ticking an opt-in box, clicking an opt-in button, selecting from equally prominent yes-no options, choosing technical settings, responding to an email, requesting consent and answering yes to a clear consent request. And you can see that all these methods fulfill the conditions that are required for the consent, which is a clear affirmative action cannot be inferred from silenced pre-take boxes or inactivity and so on. It is essential that researchers are able to demonstrate that data subjects have consented for their personal data to be processed. So records must be kept and used as evidence or for reviewing if and when required. So good record keeping should include the following. Who consented, when they consented, what they were told at the time, how they consented, have the consent withdrawn, if so, when so, these things need to be added. Consent can become invalid. Please bear in mind that I'm talking about the consent as a legal ground and if we are using it as in order to process personal data. So it's very important that you know that when consent can become invalid. So if there are doubts over whether someone has consented, if a person doesn't realize they have consented, which I think most of the time, it happens that we just consent without reading all the terms and conditions or the things. So if there are no clear records to demonstrate participants had consented, it becomes invalid. So that's important. No genuine free choice over whether to opt in was given or if there was a clear imbalance of power between a researcher and the individual, it becomes invalid. So it also becomes invalid if the consent request was vague or unclear. So always use a simple language. If pre-tick opt-in boxes or other methods of default consent was used, it becomes invalid. And especially if the researcher's organization was not specifically named or subjects were not informed about their right to withdraw, subjects cannot easily withdraw consent or the research purposes or activities have evolved since the original consent. All these, I think these are the scenarios where consent can become invalid. So just again, time for maintainator to give you a break of listening to me. A quick reflection on the consent forms that you have used for your own research projects. Few questions. So when you were designing your consent form or have you, the consent forms you have used, what format of consent you have used, written or verbal. So majority of you here have used the written one and someone has used verbal. And so majority have used written one. So if you can recall whether participants have been given the opportunity to ask questions in your consent forms. So if yes, that's great. Some of you are not sure. I can imagine that. I can't remember the consent forms I have used for my studies, whether I have done this or not. So another question. Does your consent form informs the participants about the future uses of the data, such as publications? Share and reuse. That's good if majority of you have informed. That's really important section in your consent form. If you plan to share your data, you need to obtain consent. So are you collecting any personal information? If so, have you informed the participants how it will be processed, stored and for how long? That's great if you have done that. Somebody has not. Sometimes we do not realize that these things are very important. For example, giving you my example again that I haven't informed the participants that I plan to share my data and I am collecting personal information how it will be processed because I finished my PhD in 2018 and we were not very aware of these. I think GDPR was introduced in 2018 and we were not aware. So that was the main reason. Did you use pre-ticked opt-in boxes or other methods of default consent? That's good if you haven't because as I have mentioned that consent becomes invalid if you use pre-ticked opt-in boxes or other methods of default consent. So thank you very much. Let's go to the next section. This section focuses on when to seek consent. Obtaining consent for participation in research or for future uses such as publications or for sharing and reuse of data can be a one-off occurrence or an ongoing process. Both approaches have their disadvantages and advantages. One-off consent is used for taking part in the research project only once as the name implies and it is simple and at least hassle to participants but there are disadvantages such as sometimes research outputs are not known in advance and the participants will not know about all the information they will be contributing to. While on the other hand process consent is requested continuously throughout the research project and it ensures active consent but it may not get all consent needed before losing contact and it can be repetitive for participants and they may be annoyed. So there are situations where special considerations are needed when seeking consent and it is beyond the scope of this session to go through all of these. However you can find detailed information on these on a website. I have added a link at the bottom of the slide. So again have you encountered any challenges in obtaining consent? If not could you could you envisage any challenges if you can share your thoughts on that? No challenges that's perfect situation in the context of illegal activities that's right with children exactly employees worried about implications yeah that's often the case sometimes people just say no and simply can't participate then that's right it's it's really hard to balance the information you are providing the forms being long and people being overwhelmed by what they have to read before they consent that that's true not getting consent at the time deeds too much chasing that's right when you are processing secondary data that that's right when you are processing secondary data yeah it's more sort of asking them for permission to share data or copyright clearance sort of thing giving enough information but not too much that people are put off yeah very very hard to put that balance in when collecting data in school in some educational settings with vulnerable participants yeah that's right people are not confident here whether in terms of confidentiality yeah when there is a delay in research and a project has to be extended seeking consent again yeah retrospective consent is always always the difficult one to get agreement without fully understanding that's right long forms and participant information sheets makes it all sound off-putting and like the police exactly yeah it does but I think what you what you can do is keep it short and concise and explain everything verbally and just add the things that are required so but I agree that it's always hard regarding secondary data original study didn't get sufficient consent as rules and best practice were different back then exactly that's that's the problem and it's always a problem to face every now and then when researchers come to deposit data with us the secondary one thank you very much for your thoughts so as you said sometimes researchers are faced with the challenges when sharing or archiving data especially if the data contains personal information and cannot be anonymized so and or at the at the time of data collection they do not consider obtaining consent for future uses of data specifically archiving and sharing in that case they may consider retrospective consent however participants there are instances that they cannot be traced depositing the data in our repository will need to be assessed on a case-by-case basis to identify this and whether it is appropriate to share it or possibly present it to the ethics boards for review and decision but it's always always hard the assessment is made based on the risk harm benefits disclosive nature of the data and so on and in addition sometimes researchers are faced with the challenges when participants ask to withdraw from the research this is challenging especially if the data has been collected or archived for future uses this also needs to be considered on a case-by-case basis but it is best if researchers consider this in advance and provide information about this in the information sheet and consent form sometimes there may not be a problem as the personal data is not shared or it may not or it may be anonymized but sometimes in qualitative studies where there are very less participants it could be very damaging so researchers can consider for dealing with participants wishing to withdraw they could seek a meeting to explain to the participant the cost of this to the project or they could discuss whether some of the data could be kept for example if data can be completely anonymized so there are circumstances where no form of consent can be obtained and these situations are exceptional and we need again a case-by-case review and clear arguments to satisfy the requirements of ethics review boards or repositories and there can be varied reasons why consent is not possible limited capacity may prevent a person from being fully informed data may have already been collected for another purpose that did not require consent as you have already said and consent may not be technically feasible in some very large-scale projects and but you can get detailed information regarding all of these issues on our website yeah I forgot that participants perception is another important issue if the sample comprises of children and vulnerable people patients bore awareness of their rights a failure to provide adequate information or absence of consideration of participants educational level or cultural background time constraints was of unclear language so these are the sort of issues you encountered as you have mentioned so always open to discussion is the only way out I think now I'll show you some real examples from the consent forms that depositors have used to deposit their data with us but before that I think there are three key areas that need to be kept in mind you can break down the information into these three key areas information related to participant participation in the research how the information collected will be used by the researcher and information about future uses by the researcher or by other researchers if data would be shared so that's very useful I think this is an extract of the UK data service model consent form and this section is about taking part in the study I'll let you read it quickly so you can see that it has captured several aspects such as participants have read and understand the information about voluntary participation about withdrawal anytime it also explains what they have to do how information is being collected or if there are any potential risks so this is the second section in the form in the template and this section is about the uses of information or data being collected it also addresses the confidentiality aspect by asking what can or cannot be shared so this is the third section on the template and this section is informing the participants about future use and reuse of the information and it also says that all the information where the data will be deposited in which form whether it is anonymized or if available under restrictions and I have added a UK data service model consent form template on the resources slide at the end so that you can have a look at it later so these are some example extracts that have been used in real researches I let you read this first so the first extract focuses on two things future uses of data and all forms of data that is being collected such as audio recordings transcripts and photographs they are all mentioned separately addressing the condition of granularity in the consent form while in the second example participants are being informed about the future uses such as a report content of a website archiving reused by the researchers and here you can see that they have also been told that they may be conducted again if their personal data or a quote or photograph will be used which shows an active consent or process consent which is good but not always ideal to do so in practice here again providing information regarding archiving who will have access to the data and on what condition it also states the reuse purposes so again two extracts showing how confidentiality can be maintained our personal data will be stored who can have access to it and on what conditions and where it will be stored so this is an outline of the information sheet used for a study and a researcher have provided detailed information to the participants regarding all these issues so that's that's an outline of the information sheet and I think it's quite a detailed one and captured nicely all the issues so here is an example from health research authority on their website and I found it very nice example I'm not sure I think there is someone from the clinical research but this may give you an idea how to present information to the participants here they have combined information sheet and consent form in one document and on the title page they have added consent statements addressing most of the conditions we have on earlier I have added a link on the resource slide for you if it is not clear to read so you can see that they have answered the question why is the study needed what does taking part in the study involve why have I been invited do I have to take part what should I do if I want to take part what happens during my next donation visit what will happen to my sample what happen immediately if I enroll what happens next all the information are there any benefits are there any risks how do I withdraw will be able to use my information can I know the results obtained from my blood samples who is organizing and funding the study who has approved the study what will happen if an invention is made what happens if something goes wrong who do I contact if I have any concerns so I think very it is a detailed one but they do address all the issues I see who has provided a very useful checklist for researchers that can be used when asking for consent so it is useful for researchers I let you read it quickly another checklist that's quite useful so just to take a break just short questions on mentee if you would like to answer so what do you think is the statement any information I will give I give will be used for research only and will not be used for any other purpose appropriate is it yes no it depends yeah I think there are no right or wrong answers it could be yes in your case it could be no in your circumstances and it depends because if you are planning if you have collected personal information and you are planning to share your data such statements should not be used in consent forms because these precludes data sharing and if you are not going to share some parts of data mentioned here in the consent form that personal data or identifiable information will not be shared so you need to be very specific and if you are obtaining consent just for asking for participation in research then it doesn't matter so it depends it depends on your circumstances so what about this is the statement I understand that only the research team will have access to the data I will go I think it's again the same it depends it could be yes no it all depends on your circumstances but the most important thing here is if you are planning to share your data such statements in the consent form precludes data sharing so you need to avoid such statements every now and then we the researchers come with consent forms stating these sort of statements and they have ESRC funding and ESRC requires the researchers to deposit their data within three months of the grant when the grant ends so such statements do cause a lot of problems for them so always pay attention and avoid such statements if you plan to share data so just a quick one does the consent becomes invalid if the consent request is vague and unclear yes I think it could be if in the context of legal compliance you are using it as a processing ground if it is vague and unclear it becomes invalid but in the context of us ethics asking them for participation in research I think vague and unclear statements they they are ethically wrong as well it should be clear either ethically or legally is it true or false it does not matter if the research purpose or activities have evolved since the original consent I think ethically as well and legally for sure it does matter so another one quick one consent becomes invalid if pre-ticked opt-in boxes or other methods of default consent for use that's true if you are using consent as a legal ground so using this such a statement in your consent form how is that all sensitive data from this project will be destroyed after funding ends is this statement appropriate yeah I think it again depends on your some few people have said yes some no I'm not sure it depends on your context but I think you need to be very specific most of the consent forms I reviewed have such statements in that but it's not bad using such statements if you are planning to destroy your sensitive data but you need to be very clear what data you are talking about do we mean data which will be contained in the research data set as well what about funder requirements to deposit and share data here again it is about providing clarity to participants around around which data will be deleted specifically and which will be archived so very important aspect you need to provide clear information which data you are going to delete and which data you have collected will be deposited I think that's that's it thank you very much for your responses yeah so yeah so finally the takeaway message from today's session is do not collect personal data if it is not essential always indicate clearly in a consent form where the participant consent is being asked for processing their personal data and where consent is being asked for taking part in the research as I have shown you three different sections on our consent form template and always keep consent forms under constant review and try to use different forms of consent for different materials always keep the language as simple as possible so that participants can understand avoid excessive warnings indicate the future uses of data and indicate the steps to address confidentiality issue and remember at this point that although I've gone through consent in today's session this is not the only ground there are other public interests and some other grounds as well that can be used to process personal data and if you are going to anonymize your data GDPR does not apply and always use different data sharing consent agreements for different types of research data so these are some of the resources our website model consent form example information and then there is a very useful resource but resource by the RIA the consent form visit where it's an online sort of form where you can just put in all your information and it can build your consent form based on the information you have provided so that HRA example consent form link and other information