Protecting Your Data

Transparency helps to ensure that participants and the public are appropriately informed about the processing of their personal data.

For studies where explicit consent cannot be obtained, and that apply for a consent declaration, the requirement to comply with the principle of transparency is not removed; efforts must still be made by the researchers to appropriately inform participants about the study, the use of their data in that study and inform them of their data protection rights, including rights to withdraw.

The type and extent of transparency measures that should be implemented will depend on factors such as nature of the study, the type and extent of personal data to be processed, the parties involved in the study and who the participant cohorts are. Examples of transparency measures that could be implemented include study websites, notices within clinics or hospital settings, social media and engagement and cooperation with relevant representative groups to promote the study.

For studies that will seek to obtain the explicit consent of the study participant, information about the study and the processing of data is typically provided in the relevant consenting documentation. It is the responsibility of the researchers to ensure that the information provided in documents such as a participant information leaflet and consent forms provide sufficient clear details on what will happen with regards the processing of personal data and that they are tailored to the participant cohort in question.

The Department of Health has drafted Guidance on Information Principles for Consent to assist researchers and a link to this is provided below.

Separately, the HRCDC Secretariat has provided an information document on study information leaflets if seeking a consent declaration; this document can be found on the Application form and Amendment form webpage of this website.

Please note these documents should not be considered as legal advice or legally binding; they are provided for the purpose of guidance only.

While researchers may be of the view that obtaining the explicit consent of the participant to process their personal data is very challenging, it may still be considered reasonable to make efforts to seek to obtain the participant’s consent, where practicable. For example, the study may involve a small number of participants, making obtaining consent possible. It may also be the case that some participants may still be attending the hospital or clinic for follow-up and therefore they could be requested to provide consent.

In addition, where participant consent cannot be obtained due to their level of decision-making capacity, it may be considered appropriate is to request proxy assent from a suitable individual who understands the participant’s will and preferences, for example from a relative. While such ‘proxy assent’ is not valid consent for data processing, it is viewed as an additional safeguard.

The consent declaration application form includes sections relating to seeking participant consent and whether a proxy assent process will be implemented, the responses to which are considered by the HRCDC.

It is still considered important to ensure that participants who may lack decision-making capacity, and their families, are involved in the decision-making process and study activities to the greatest extent possible, and ensuring that all efforts are made to hear and understand the participant’s will and preferences.

Linked to this it should not automatically be assumed that the research participant lacks decision-making capacity, and it is important to assess capacity from a functional, rather than a medical, perspective. Researchers should refer to the principles of the Assisted Decision Making Act when determining the decision making capacity of a potential study participant. Efforts should also be made to determine whether an individual has a co-decision-making or representative agreement in place. Please see FAQ #23 in the Frequently Asked Question webpage for more information on this matter.

Where personal data (including pseudonymised data) is transferred between parties, where there are joint data controllers of a research study or where a data processor is employed to process data, then it is crucial that the necessary and suitable data agreements and arrangements are in place.

Data agreements and arrangements are an important element governing the use of personal data such as who will process the personal data and for what specific purposes, the type and extent data to be transferred and processed, data security and sharing responsibilities and obligations are clear regarding the exercising of participant rights. Additional agreements and arrangements may also be required if personal data is to be processed outside the European Economic Area.

Requirements for data controller to data processor agreements and joint data controller arrangements are set out in the GDPR and therefore need to be met even if a consent declaration is not required.

The HRCDC may attach conditions requesting that the measures put in place to protect the data are reviewed and strengthened to better protect the security and privacy of personal data. Researchers have been asked to ensure that encryption is used to protect study files, not to use USB sticks and to transfer data between parties via secure methods such as online data portals.

In studies where participant consent may be deferred and/or where proxy assent from a relative or friend will be obtained, researchers are requested to submit copies of the study information leaflets and assent/consent forms that will be used. As a condition to a consent declaration, the HRCDC has requested that changes be made to these important study documents to help ensure clarity and consistency of information for the proxy and/or participant.

Data minimisation means that the research study should only process (access, collect, analyse, store etc.) the minimum amount of personal data needed to address the research question for the minimum amount of time. The HRCDC has attached conditions or recommendation requesting that the study review the extent of the personal data to be processed and the length of data archiving. For example, the HRCDC has asked data controllers to consider if date of birth or address is needed and whether age or county could be processed instead.