 Hello everyone, welcome to this UK data service workshop on consent issues data sharing. My name is Hina and I work as a senior research data officer and my main responsibilities include providing guidance and training on ethical and legal issues in data sharing. And my colleague Gail is also here in today's session, she is helping us with the technical side of things. The overall aim of this session is to show you the role of informed consent in sharing data within ethical and legal boundaries. I aim to cover the following in this section. In the first section, I'll talk you through why we need consent. This section will focus on introducing the use of informed consent in research. The second part of the session is about how consent can be obtained, covering documentation and methods that are used to obtain consent and finally how to manage the obtained consent forms. This is then followed by a section on when consent could be sought during the research process. Some of the important aspects that need to be considered are also discussed. And the final section focuses on sharing with you some of the wordings used in consent forms by the researchers and example consent forms and information sheet. I'll finish it off by highlighting some best practice tips and resources that can be very useful for you if you are interested in data sharing. And I will respond to your questions in the end. So as I mentioned, the first section is about why we seek consent. So the first question is if you would like to give a quick introduction to your background. For example, if you are a post grad, early career researcher, professional services staff, that would be great. It's a biomedical someone from biomedical sciences. That's interesting. Early career researcher, open service staff, research, sports staff, clinical trial unit, very diverse, I think. That's good. Great. Soft different backgrounds. Someone in the chat said, I love this animation. Yeah, me too. That looks very amazing. Great. Thank you. And what type of data are you interested in or you are working with? Is it called, font or mixed data? So majority of you are doing the mixed method and some qualitative and some quantitative. That's great. So the last question on mentee, what do you think, why we seek consent in research? Any thoughts on that? I'm sure everyone is familiar. Looking at the background you have just mentioned, ethical, legal, research integrity, GDPR, protection of participants. Yep. So participants can make informed decisions. True ethics, informed participants of use of their data. That's right. To adhere to ethical standards, ethical, good practice, GDPR, very well informed attendees. I'm impressed. Thank you. And I'm sure that all the responses they are showing that it's either the legal or ethical compliance and somebody in the chat have written that it's for legal purposes and to protect ourselves and participants as well. That's right. So it is all of the above. That's right. Fundamental obligation that that's right. Protection for researchers, ethically use people's private info. Exactly. That's right. So thank you very much for your responses. So clearly you all are very well familiar with what informed consent is. It is the process by which a researcher discloses appropriate information about the research so that a participant may make a voluntary informed choice to accept or refuse to participate in the research. And in the research context, consent is obtained to ensure that participants understand what they are signing up to making participation and research more effective. And it also ensures that the research conducted is ethical and compliant with the data protection regulation. So thank you very much for your responses. So basically, looking at your responses and that's the fact that in research context, we need consent for two purposes. Consent for research participation, which is considered as one of the founding principles of research ethics where it is sought before participation in any research activity and for all participants. And as you are aware that it usually involves providing information regarding study purpose, benefit, voluntary participation. However, it can also be used to comply with the data protection regulation, as you mentioned in some of your responses. And if a researcher collects managers and share personal data, then consent of the data subject can be used as a legal base to process this personal information under the UK GDPR. So basically, there are two legal frameworks that are relevant here, which is the common law duty of confidentiality and data protection legislation. I will go through both of these. In the UK, there is a duty of confidentiality that is based in common law and that occurs where confidential information comes to the knowledge of a person in circumstances where it would be unclear if it were then to be disclosed to others. However, there are some exceptions when you can disclose information. For example, if participant consents to onward sharing their personal data, then sharing does not reach duty of confidentiality. And sometimes public interest can overwrite duty of confidentiality. And, occasionally, there are instances when you may need to give up data such as court order. The best practice is to avoid very specific promises in consent forms. As researchers, we must adhere to data protection requirements when managing or sharing personal data. And personal data is any information relating to an identified or identifiable natural person. People can be identified directly or indirectly. Some of the examples of direct identifiers are name, address, post-port, telephone number, voice, picture, while some examples of indirect identifiers are occupation, geography, unique or exceptional outliers in the data. So if personal information about people is collected or used in research, then the general data protection regulation applies. However, if data is anonymous, GDPR does not apply. So a bit of background to the GDPR is necessary here. GDPR is the EU-Wide Data Protection Regulation that was introduced in 2018 and replaced UK Data Protection Act that was used until that time. However, after Brexit, it is now called the UK GDPR. Currently, both EU and UK GDPR are aligned. They place the same legal obligations on researchers. But in the future, the two pieces of legislation may diverge as the UK has now left the EU. It will therefore be important for researchers to ensure that they gain local support from their university, especially when their research project will span across the EU. So if the researchers based in the UK collect personal data about people anywhere in the world or a researcher outside the UK collect personal data on UK citizens, then DPA and UK GDPR both applies. However, if the researchers are undertaking research projects which span across the EU, then the EU GDPR will also need to be considered. So there is usually a misconception that data protection laws such as UK GDPR prohibits data sharing. However, it does not prevent data sharing as long as you approach it in a sensible and proportionate way. In fact, GDPR is useful for research because it legalizes much of the current good practice in research, such as data sharing and archiving. Until the UK GDPR, there are six possible grounds for processing personal data and one of these must be present. These grounds are consent, public interest, legitimate interest, protection of vital interest, legal obligation and performance of a contract. However, in the context of research, the first three, which are consent, public task or legitimate interest are the most applicable grounds for the processing of personal data. Through the consent, I think you are all aware that consent is rarely used as a legal ground in the UK. But if you are using it, you need to make sure that you fulfill certain conditions associated to the consent you are obtaining. For example, it must be freely given, informed, unambiguous. It should be specific, such as if it is for audio recording, video recording or so on, you need to mention it. It must have a clear affirmative action and cannot be inferred from silence pre-tick boxes or any activity and make sure that the participants were given the opportunity to request to remove their personal data at any time. And this request to withdraw is for removing their data and not a withdrawal from research, which is ordinarily asked in the consent form. So these are two different things. It must be documented. And finally, an explicit consent is required to process special category data, which is race, ethnic origin, politic, political views, religion and health and so on. So in the UK, Information Commissioner's Office, which is usually called ICO, advised that for almost all research conducted in the UK organizations should rely on either public task for all public bodies or legitimate interest for non-public bodies. However, the ones holding and using health information, which is a special category of personal data in GDPR will also require a further condition in addition to the public task. In academia, this is usually to support scientific and historical research. In addition, you also need to complete a data protection impact assessment for any type of processing, which is likely to be high risk. You must therefore be aware of the risk of processing the special category data. As I mentioned, that explicit consent is mandatory if you process special category data, explicit or confidential information under common law or duty of confidentiality. This comes under that. So a quick info on explicit consent if you are to obtain it. Ordinary consent can be obtained verbally or in writing. However, explicit consent should always be recorded or documented. There are certain conditions that needs to be adhered to, otherwise the consent can become invalid. For example, if no genuine free choice was given or if there was a clear imbalance of power between a researcher and the individual, it becomes invalid if the consent request was vague or unclear. If the researcher's organization was not specifically named, subjects were not informed about their right to withdraw and so on. So explicit consent statement should specifically refer to the particular data set that is to be processed. The precise purpose of processing, including any automated decision-making, should identify any risk implications that might arise for the data subject as a result of the data processing and it should provide any other relevant and specific information that might influence the decision of a data subject to give or not to give their consent. So this and couple of the following slides are the screenshots of a very nice checklist from University of Dublin in order to assess if your explicit consent form is in line with the GDPR and health research regulations. So I have provided a link on this slide. You can have that if you need it later. So I found this checklist very useful to check the explicit consent form you are using for your own project. And I have added a link to the Health Research Authority guidance on obtaining explicit consent at the bottom of the slide, which you can check later on. So apart from being good scientific practice in some countries, gaining informed consent is mandated by law. For example, here you can see that some countries have mandatory requirement to obtain consent. If you collect personal data, however, there is no legislative requirement for consent to be sought from participants in the UK. However, funders or research ethic committees and ethic guidance for these may require it. If any one of you are from any other country where obtaining consent is the mandatory requirement, just if you would like to share us in a chat, joining from Germany. So in Germany, it is a mandatory requirement if personal data are collected in the Netherlands. It's the same in Netherlands as well. All right, so yeah, it's not a mandatory requirement in the UK. Yeah, somebody asked that if I could explain what the table describes. I was saying that some countries have mandatory requirement to obtain consent if you collect personal data. However, in the UK, I was just comparing some of the countries with the UK that in the UK, we do not have a mandatory requirement to obtain consent. We use public task as a legal base to process personal data. But if we are processing special category data, then we need to obtain one additional condition, which could be for academia, it's scientific research and for health research, I think it's explicit consent. That's the comparison between other countries and the UK. Somebody asked, does this mean we are doing research in one of these countries? It would be legally required to have consent. I think so, yes. If you are based in the UK and you're collecting data from any other country, you need to adhere to that country laws as well, as well as UKs. So you need to check with them where you are collecting data. So someone from Greece, someone from Poland, not sure how it is regarding legal regulations here. Yeah, sometimes it happens. And Isabel has written that, what about if someone is doing research where they collect personal data brought? Yeah, it's exactly the same. When you are based in one country and you are collecting data in another country, you need to follow the rules and regulations of both the countries. If you are conducting interviews with people from around the world, what would you do then around the world? I think it depends if you are going to share the personal data or personal or any identifiable information in that data, then you need to consider what you are going to do. If you are collecting data from around the world and you plan to share that data in some repository, like UK data service, then the first thing is to obtain consent. If it is not possible, then you can anonymize the data. You just remove the direct identifiers or personal information and then you can do that. And if it is the interview transcripts, again, you can anonymize the transcripts if that possible. And if it is not possible or the data will lose its value, then I don't think so that you can deposit the data unless you have consent. Ethically speaking, consent is necessary if you are to share the data. And to keep it in mind that I am talking about in this workshop, the issues related to when it comes to data sharing. So if you are conducting interviews, okay. Yeah, so as long as you anonymize everything, it is all right. Yeah, if the data is anonymized, GDPR does not apply, as I said earlier. So apologies, this may be answered later on, but if you are collecting data from children, young people and vulnerable communities, is it still not legally required in the... Yeah, it is. I will address this in my later slides. If it is anonymous at the point of collection rather than being anonymized later. Yeah, I think so. GDPR does not apply if you anonymize the data later. Keep it yourself. And if you plan to share that data, then you need to deal with it, either on anonymization or to update retrospective consent. So do you need... Good question indeed. Do you need consent for the process of anonymization? Yes, you have to. I will go through in my later slides when I show you the template UKDS proposed for the researchers. And in that template, you will see that you need to inform the participants what you are going to do with the data, how the anonymization is going to take place, how you are going to store the data. Informing the participants is their ethical right as well as legal right. So it's ethically important that you inform the participants about anonymization. So it should be in the consent form what you are going to do with their data, whether it is anonymized, whether it is not anonymized, whatever is going to be done with the data. And another comment, if the data is anonymized, GDPR does not apply to sharing that data. But the researchers still need to inform consent to collect and process that data, ethically speaking. As I said, there are two purposes you obtain consent for, ethics and legal compliance. So in the UK, we do not use consent as a legal base to process personal data. But ethically speaking, you need to inform the participants what you are going to do with their data. If there is no such statement in the consent form, we cannot archive their data. So it's an ethical obligation, so that that is the main difference. While we do not require it legally, but we do require it ethically. I hope so, I'm clear, but you will be clear after some slides. So the next section is about how to seek consent. It includes format, student consent, documentation, methods and record keeping sort of things. So consent can be given in written or oral form. The format of the consent depends on the kind of research. However, it is important that whatever format is used, written or verbal, it should be documented. You need to document how it has been gained, what information was being provided and what they have agreed to. So as I said, consent can be written or verbal. Both formats have pros and cons. For example, written consent has more solid legal ground. For example, participants have agreed to disclose confidential information. You can show this in writing. And this is the form that is usually required by ethic committees. And most of all, it offers more protection for researchers as they have written evidence of consent. However, it is it cannot be used in some instances such as illegal illegal activities. And on the other hand, verbal consent are best if recorded. But sometimes it is hard to make all issues clear verbally. And most of all, it can pose greater risk for researchers in regards to adequately proving participant consent. And it may also scare people from participating and have them think that they cannot withdraw their consent. So it depends on the project as well, what is best for your project. Typically written consent documentation includes an information sheet and a consent form signed by the participant. And this division allows the background information to be as detailed as necessary while keeping the signature form short and concise. And information sheet should cover the following. I'm sure you are aware with this purpose of the research, what is involved in participating benefits, risk, procedures for withdrawal, future uses of data, such as storage, publishing and archiving and other details of the research, such as funding source, sponsoring institution, name of project, contact details and how to file a complaint if there is any. So researchers also need to make sure that consent form should use simple language and it should allow the participants to clearly respond to points such as they have read and understood the information about the project. They have been given the opportunity to ask questions and they voluntary agrees to participate in the project. They understand that they can withdraw at any time without giving reasons and without penalty and future uses of the information that is being collected, such as publication, data sharing and so on. And signatures and dates of signing for the participant and the researcher should be there as well. And if personal information is collected, best practice is to provide information about how personal information will be processed and stored and for how long. Excuse me. Procedures for maintaining confidentiality should be there, whether real names will be used or not, if data will be anonymized, how it will be anonymized. It should also state procedures for ensuring ethical use of the data, especially in the context of archiving and reuse. If the GDPR applies, then further information needs to be provided in the consent form, such as the contact details of the data controller and just to let you know, data controller is the entity that determines the reason for processing personal data. It could be a data protection officer at your organization or a researcher consent form should also state who will receive or have access to the personal data. It should also have a clear statement on the rights of the participants because participants can request to access their data. They may ask for corrections or even removal of their personal data and these things needs to be communicated to the participants. However, you may use some of the information, some of the information in the information sheet and some in the consent form. So please have a look at UK data service model consent form where you can find detailed guidance along with the template to get a clear understanding. But I will show you the template here in some later slides that are coming up. So different methods can be used to obtain consent. ICO has recommended the following, signing a consent statement on a paper form, ticking an opt-in box on paper or even electronically, clicking an opt-in button or link online, selecting from equally prominent, yes, no options, choosing technical settings or preference dashboard settings, responding to an email is also considered a consent and answering yes to a clear oral consent request. You can see that all these methods fulfill the conditions that are required for the consent, which shows that these are clear, there is a clear affirmative action. It cannot be inferred from silenced pre-tick boxes or any sort of inactivities, thereby opting any of these methods. So it is also essential that researchers are able to demonstrate that data subjects have consented for their personal data to be processed. So records must be kept and used as evidence or for reviewing if and when required. Good record keeping should also include the following, for example, who consented, when they consented, when they were told at that time and how they consented and have the consent withdrawn and so when it was withdrawn. Consent can become invalid if there are doubts over whether someone has consented. If a person doesn't realize they have consented, there are no clear records to demonstrate. No genuine free choice was given or whether to opt in was given or not if there was a clear imbalance of power between a researcher and the individual. Yeah, and it also becomes invalid if the question request, if the consent request was vague or unclear. If pre-ticked opt-in boxes or other methods of default consent were used, the researchers organization was not specifically need. Subjects were not informed about their right to withdraw. Subjects cannot believe withdraw consent or the research purposes or activities have evolved since the original consent. So you see how important these things are if you are using consent as a legal base to share personal data. And though it is not mandatory here in the UK, but from the ethical compliance perspective, these are useful. Which format of consent you have used in your research or you are planning to use? Is it verbal or written? So that's interesting. Someone has, a couple of people have used the verbal ones as well. Online paper, board, start of interviews, written, some extra responses, a tick box in a survey. That's great. So both, both form of consent have been used by some of you. So that's good. So if you remember, I don't think so. People do remember as I can't remember what I have done for the studies I have conducted. Have you given the opportunity to ask questions? If you remember. So majority do remember which is good. So someone says no. If I have to answer, I will say not sure because I have done my PhD a few years ago. And I don't remember whether I have done that or not. If the participants were given the opportunity to ask questions or not at that time. We were not aware of such things. Yeah. So that's very good. Majority of you have given the opportunity to ask questions. That's great. Did your consent form inform the participants about future uses of data such as publications, data archiving? That is again very great if you have done that. Some of the consent forms, the collections we receive from researchers, some of the forms did mention about research publications and out research outboards, reports, but they are missing about any information conveyed to the participant regarding data archiving. So some people do mention publication and other bits, but they do miss the data archiving. And it is important because these days the funders such as ESRC, they make it mandatory that researchers should deposit the data for future reuse within the three months, I think, when they're grants. And so it's very important to convey to the participants that their data is going to be anonymized, sorry, to be shared or archived for future use. I think there is one more. So are you collecting personal information if so have you informed the participants how it will be processed, stored and for how long? Yeah, so these are very important questions that should be in there if you plan to share data, especially if you are planning to share it. So someone in the chat written that they have given the participants the contact details and the contact of their supervisor for any questions they may have. Yes, that is also good. That's great majority of you did and some of you are not sure like me and some have not done that. So yeah, I think that's that's the. That's all. Thank you very much for your responses. I think you may get a chance to get some break from the too much information and content. I'm going to, I have gone through and I'm going to speak to and some points to reflect on the next section focuses on when to seek consent. And obtaining consent for participation in research or for future uses such as publications or for sharing and so data can be a one of occurrence or an ongoing process. Both approaches have advantages and disadvantages. One of consent is used for taking part in a research project only once it is simple and at least hassle to participants, but there are disadvantages such as sometimes research outputs are not known in advance and the participants will not know about all the information they will be contributing to. So that is the main disadvantage. On the other hand process consent is requested continuously throughout the research project. It ensures active consent, but it may not get all the consent needed before losing contact with the participants and it can be repetitive for participants and they may be annoyed. So I don't think so that in the research community that is the preferred way. There are situations where special considerations are needed when seeking consent. It is beyond the scope of this session to go through all of these. However, you can find detailed information on these on our website. I have added a link at the bottom of the slide. So can check the all the information in your own time. Sometimes researchers are faced with the challenges when sharing or archiving data, especially if the data contains personal information and cannot be anonymized. And at that time of data collection, they do not consider obtaining consent for future uses of data specifically archiving and sharing. And in that case, they may consider retrospective consent. However, if participants cannot be traced depositing the data in a repository will need to be assessed on a case by case basis to identify whether it is appropriate to share it or possibly presented to the ethics board for review and decision. The assessment is made based on the risk, harm benefits, disclosive nature of the data and so on. And in addition, sometimes researchers are faced with the challenges when participant asked to withdraw from the research. This is challenging, especially if the data has been collected or archived. This also needs to be considered on a case to case basis, but it is best if researchers consider this in advance and provide information about this in the information sheet or consent form. Sometimes there may not be a problem as the personal data is not shared or it may be anonymized, but sometimes in qualitative studies where there are very less participants, it could be very damaging. So researchers can consider for dealing with participants wishing to withdraw. They could seek a meeting to explain to the participant the cost of this to the project or they could discuss whether some of the data could be kept. For example, if data can be completely anonymized or not. And there are circumstances where no form of consent can be obtained. These situations are exceptional and will need again a case by case review and clear arguments to satisfy the requirements of ethic review boards. And there can be varied reasons why consent is not possible. Limited capacity may prevent a person from being fully informed data may have already been collected for another purpose that did not require consent such as larger government administrative data where consent may not be technically feasible. So you can get all these in a detailed form on our website. In addition, participants perception or if the sample comprises of children and vulnerable people. Patients poor awareness of their rights failure to provide adequate information absence of consideration of participants education level or cultural background time constraints on clear language. All these are the challenges that researchers do face. And in terms of data sharing, if not communicated clearly participants are skeptical of confidentiality issues as well. So always try to think carefully always be open to discussions. So now I'll show you some real examples from the consent forms that depositors have used to deposit their data with us. But before that model consent from from the UPS, I'll show you that. But before showing the model template. The information in the consent form can be broken down into three key areas. So information related to participation in the research, how the information collected will be used by the research and information about future uses by the researcher or by other researchers if data would be shared. So just keep in mind these three key areas when you look at the screenshots of the model consent form of UK data service in the following slides. So this is and this is the screenshot of the UK data service model consent form one section. This section is about taking part in the study. So I'll let you read it first. So you can see that it has captured several several aspects such as participants have read and understand the information about voluntary participation withdrawal. It also explains what they have to do how information is being collected or if there are any potential risks. So this is the first section in our template. So this is the second section in the template, which is about the uses of information or data being collected. It also addresses the confidentiality aspect by asking what can or cannot be shared. And then this section in the template is informing the participants about future use and reuse of the information. All the information where the data will be deposited and it also mentions that in which form, whether it is anonymized or if available under restrictions. So this answers one of the questions in the chat about whether we need to inform the participants about anonymization or not. So these are some example extracts that have been used in real consent forms that were deposited by the researchers. I'll let you read it quickly. So the first extract focuses on two things future uses of data and also all forms of data audio recordings transcripts and photographs are mentioned separately addressing the condition of granularity. And in the second example, participants are being informed about the future uses such as a report content of a website archiving we use by other researchers here. You can see that they have also been told that they may be contacted again. If their personal data or a code of photograph will be used which shows an active consent or process. Again, another extract that provides information regarding archiving who will have access to the data and on what conditions and it also states that we use purposes as well. And both of these extracts show how confidentiality can be maintained, how personal data will be stored, who can have access to it and on what conditions and where it will be stored. Yes, someone mentioned in the chat that length of use or archiving not mentioned. Yeah, maybe in some extracts archiving is not mentioned, but I have added here to highlight another purpose and length of use should not be mentioned. Time of storing personal data should only be mentioned and it is based on institutional policies. If you store data with UK data service, it is in perpetuity. It is not stored for some for specific number of years. So, yeah, it's good that you mentioned that you are going to store the data, archive the data in such and such repository for in perpetuity. And for the personal data, if it is stored in your institutional machine, you can say that depending on your institutional policy that it is it will be destroyed after so and so years. Personal data should not be kept if it is not required. So, I'm sure by now you have an understanding that though not legally, but ethically, we need to inform the participants about the future uses of the data we are collecting. Unfortunately, most of the time we receive collections that have problematic consent forms for example statements like these. For example, this first statement any information that I give will be used for research only and will not be for any other purpose. And I understand that only the research team will have access to the information I provide such statements precludes data sharing. We cannot deposit the data if the consent form have such statements and the only alternative is to go back to the participants and obtain retrospective consent, which is always not at all. So, these always try to avoid such statements in your consent forms because these preclude data sharing, then they are usually advised to obtain as I said they are usually advised to obtain retrospective consent. And it's not an ideal situation. Another problematic statement is data will be destroyed after so and so years or when research is published or grant ends. This also precludes data sharing. Here researchers need to specify which data. Do we mean data which will be contained in the research data set as well? What about funder requirements to deposit and share data? Here again it is about providing clarity to participants around which data will be deleted specifically and which will be archived. So, you need to mention that personal data will be destroyed and the remaining data will be archived. It's just providing clarity. Most of the time they wanted to indicate personal data but missed the term personal. So, here is an example from health research authority. It is a very nice example about a blood donation study. And I'm not sure how many of you are health researchers but this may give you an idea how to present information to the participants. Here they have combined information sheet and consent form in one document. And on the title page they have added consent statements addressing most of the conditions we have gone through. So, you can see that on the second page they have provided information. Why is the study needed? What does taking part in the study involve? Why have I been invited and am I eligible? Do I have to take part? What should I do if I want to take part? What happens during the process? What will happen to their blood sample or you can say their information collected? What happens immediately after I enroll? What happens next? Benefits, race, information about withdrawing. And who will be able to use the information? Can I know the results? Who is organizing and funding? Who has approved the study? What will happen next? What happens if something goes wrong? Do I need to contact? So, a very comprehensive list I would say. So, the takeaway message from today's workshop is do not collect personal data if it is not essential. And always indicate clearly in the consent form where the participant's consent is asked for processing the personal data or it is asked for participation in the research. Keep consent forms under constant review indicate the future uses of data, especially the archiving. These are some of the resources that you will find very useful in terms of the consent form. There is this one, the RIA elder consent form visit. It's an online thing. You just keep on answering the questions that it will prepare your consent form. So, you will find these resources useful. And thank you very much for attending today's session. You can always send me an email if you have any specific project related questions and I am happy to answer that.