When conducting research at FGB, it is imperative that data are used ethically and legally. The vast majority of data used in our faculty’s research are personal data1 and when personal data are utilized for research, the General Data Protection Regulation (GDPR) applies. Under this regulation, one of our most fundamental requirements is to inform people that we are using their data in our research. The following checklist helps you ensure that you are meeting the requirements imposed by the GDPR.

Required Information

Privacy Statement

The VU’s Legal Affairs department has developed a privacy statement template which you can obtain from the FGB Privacy Champion. This statement ensures that all legal requirements are met and it should ideally be published somewhere online so that research subjects can refer back to it at a later stage or review it should there be any changes to the information that was given at the outset. FGB recommends publishing the privacy statement on OSF so that there is a permanent public location where the privacy statement can be found. You can refer to this location in your information letter and consent form so that participants can investigate the detailed privacy aspects of the research at their leisure without being overwhelmed by too much information.

Some privacy-related topics should still be addressed in the information letter and/or consent form. The following section explains how to adjust your consent forms and information letters to meet these requirements, as well as how to use the privacy statement by itself in the rare cases where consent cannot be obtained.

Information Requirements at Other Moments

There are other situations, aside from informed consent processes, where information must be provided to individuals whose data you are using. In these situations, information is provided through a publicly available privacy statement. You can contact the FGB Privacy Champion for a privacy statement template.

✓ When are these other moments?

Situations where information must be made available to the individuals whose data you are using include the following:

  • If consent is absolutely not feasible for your research. Possible cases where this may apply are discussed in the Code of Ethics.
  • If you are reusing data from a third-party and the GDPR applies to these data (see article 4 of the FGB Policy Positions on the GDPR), information must still be provided to the original research subjects about what their data will be used for.
    • It is, of course, the responsibility of the third-party to legally collect and share the data with you, but you are responsible for providing some publicly available information about what you plan to do with the data.
  • If you are conducting longitudinal research that started before 2018 (when the GDPR came in to force), it is important to check that your consent procedures meet GDPR requirements. If your original consent process did not meet GDPR requirements, but there is no way to renew consent with the participants, you must still make information that meets GDPR requirements publicly available.
  • If children who are participating in your research reach 16 years of age while you’re still using their data, they must be given the opportunity to reaffirm the consent they previously gave with their parents/guardians. If these participants can no longer be directly contacted, the information must be made publicly available to them.
✓ Who is Accessing the Data?
  • The privacy statement template addresses almost all of the requirements for these extra information moments, including most of the concerns about who has access to the data. However, it does not currently account for data sharing for reuse or reviewing archived data for verification of research findings. This information should also be included in the privacy statement. The FGB Privacy Champion can help you adjust the text of the template to address these concerns.

GDPR Principles for Consent

In addition to the required information, there are also some basic principles that must be applied for consent to be legal under the GDPR.

✓ Consent Must Be Freely Given

  • Consent must always be voluntary. Assess whether there is any power imbalance between you and the participants that could influence whether they feel free to consent.

✓ Consent Must Be Unambiguous and Explicit

  • “Unambiguous” consent means that consent must involve a clearly affirmative and deliberate action by the participant; in other words, the participant must actively “opt-in”.
  • “Explicit” consent is required when special categories of data are used in your research. Explicit consent means that the individuals are fully informed about what special data are collected and how those data will be used.

Children and Consent

  • The FGB Ethical Guidelines require that children from 12-16 years give consent to participate in research in addition to the consent from their parents/guardians. Children under 12 must assent to participating.
  • The GDPR requires consent from at least one parent/guardian for anyone under 16 years of age if their personal data are used in your research.
    • If a participant was younger than 16 when they originally gave consent for the use of their data, and the data are still in use after they turn 16, then attempts should be made to reaffirm the original consent. Aim to contact this participant so that they have the opportunity to affirm, change or withdraw their consent
      • If the individual does not respond, or it is impossible to reach them, the consent obtained from their parents is still valid for the specific purposes described in the original information letter.
      • If reaching these participants will be impossible, you must at least publish a privacy statement about the ongoing use of the data.

Digital Consent

  • Consent is often collected with paper forms, but in some cases digital consent may be preferable.
    • Most WMO research requires the use paper consent forms, however, digital consent is now possible in some cases. If in doubt about whether you can use digital consent for your WMO research, contact the Amsterdam UMC METC for advice.
    • For all non-WMO research, you may use digital consent if necessary. Under the GDPR, you are not required to obtain a research participant’s signature on a consent form, you just a clear indication that they “opted-in”, such as by checking a tickbox via Qualtrics or Survalyzer. However, if you prefer or are required to obtain a signature on your consent forms, this can also be achieved with digital consent:
      • If you use Qualtrics via the VU Single Sign-On, you can add a signature field to a digital consent form.
      • You can also use ZIVVER to securely send consent forms to participants and receive a scanned, signed copy in return. More information on setting up ZIVVER for this purpose is found in this instruction manual.
  • With digital consent, always make sure you are allowed to use someone’s contact information for requesting their consent digitally. You aren’t allowed to just send digital consent forms to a list of e-mail addresses that some third-party gave you unless all of those people consented to being contacted.
  • Ideally you should ensure that consent is validly obtained from the correct person, especially when working with vulnerable populations. Two-factor authentication can help with this, e.g. a participant can fill in their digital consent along with their e-mail address; afterwards, they confirm their participation in an e-mail they receive.

  1. The GDPR does not apply if and only if all of your data fall into the “Blue” category of Privacy Risk. If all of your research data are “Blue”, there can still be an imperative for an informed consent process. For example, if the data you are collecting are “Blue” data from a research participant in the lab, you still need to inform the subject of what to expect during their participation and get their consent to participate. In such a situation, obtaining consent without collecting additional personal data such as a name and signature is often advisable (e.g. the participant should be given information and give their consent by ticking a checkbox), however you should discuss this with the FGB Scientific and Ethical Review Board (VCWE) before proceeding.↩︎