diff --git a/topics/informed-consent.qmd b/topics/informed-consent.qmd new file mode 100644 index 000000000..e66a209f3 --- /dev/null +++ b/topics/informed-consent.qmd @@ -0,0 +1,48 @@ +--- +title: Informed consent +categories: +--- + +Processing personal data requires a legal ground. One of the most common legal grounds used in scientific research is asking participants for their consent. + + +## Consent as a legal ground + +In order for consent to count as a valid legal basis, several conditions must be met. + +* Participants must be informed about the processing of their personal data **before** the processing takes place. +* Consent must be given **freely**. Participants should not be pressured to participate and should have the genuine option to say no. +* Consent must be **specific** and **informed**. Participants should know for which purpose(s) their personal data are going to be used, why, by whom, and for how long. +* Consent must be **unambigious**. Agreements between researchers and participants must be expressed by using clear and plain language. The researcher is responsible for ensuring that the participant's consent is fully understood and leaves no room for misunderstanding. +* Consent cannot be implied. It should be achieved through an opt-in, a declaration or an **active** motion. Consent is not valid if it is given through silence, default selections (pre-ticked boxes), or by doing nothing. +* Consent must be **revocable**. A participant should be able to withdraw their consent at any time. If they do, their personal data can no longer be used for the research and should be deleted if possible. It is important that withdrawing consent is made as easy for the participant as providing consent. + + +## How to ask for consent + +Securing consent can be achieved in various ways. You could ask participants to sign a document (online or on paper), ask them to give an affirmative statement via an audio- or video recording, or ask them to tick a box ☑ or answer an email. You may choose whichever of these options suits your need. However, in accordance with [Article 13](https://gdpr-info.eu/art-13-gdpr/) of the GDPR, it is mandatory to provide certain information to your participants. This information is typically provided in writing (via an information letter or privacy statement). Therefore, preference is generally given to ask consent via a form (online or on paper). + + +* When asking for consent via an online form, VU researchers are advised to use [Qualtrics](https://rdm.vu.nl/topics/qualtrics.html). +* Store your signed consent forms securily (seperate from the data). +* Consent form documentation needs to be archived for as long as the data are in use. +* When processing special categories of personal data, you are required to ask your participants for explicit consent. Special categories of data include data related to a person's race, ethnicity, political views, religious or philosophical beliefs, trade union membership, genetics, health, biometrics, sex life, or sexual orientation. +* Different rules may apply when processing personal data that falls under the Medical Research Involving Human Subjects Act (WMO). +* For research that involves participants under the age of 16, additional consent is required by a parent or guardian. Please note that this law may be subject to national regulations. + + +## Dos and Don'ts when asking for consent + +| **Dos** | **Don'ts** | +|-----------------------------------------------------------------------------------------|-------------------------------------------------------------------------------| +| Indicate how you will de-identify the data (where possible) | Use terms such as "fully anonymous" unless you are absolutely sure | +| Indicate when and under what conditions others may be allowed to access the data | Say "I will be the only one with access to the data" | +| Mention that the data will be kept on secure servers with appropriate protection levels | State the name of the specific storage or archiving solution (systems change) | + + +## Examples and templates + + +## Support in your faculty: Privacy Champions + +Each faculty has one or more Privacy Champions, who are the first point of contact for questions relating to privacy and the GDPR. The Privacy Champions can help you with completing a Data Protection Impact Assessment, registering your research in the record of processing activities, designing informed consent forms and other questions relating to the GDPR. The 🔒 [list of Privacy Champions](https://vu.nl/en/employee/privacy-and-information-security/privacy-champions-information) can be found on the VU website.