Prior to participation in any research, human subjects or participants have to provide informed consent (Falagas et al., 2009; Neff, 2008). This usually is done by signing a consent form after being provided with thorough information on the concerning study. At least the participant should be informed on:
- the researcher’s identity
- the data being collected and what data is being used
- the purpose of any data processing step
- the existence of the right to withdraw consent
- confidentiality protection and the limitations thereof
- time and nature of data storage
Data protection impact assessment
A data protection impact assessment (DPIA) is expected or even mandatory to be carried out in every situation where personal data is collected or processed. Hence, for data donation studies a DPIA will always be required. A DPIA is documentation in which is described exactly how data will be collected, processed and stored (Demetzou, 2019; Hoofnagle et al., 2019).
Furthermore, in a DPIA the researcher needs to reflect on situations in the data handling process where privacy of participants potentially could be violated. They need to argue how they minimize these potential risks. The DPIA mainly concerns the steps in the workflow of constructing the extraction script and configuring the data donation tool. The DPIA should be adjusted to the type of data that is collected in the study. Studies with data collection on sensitive topics require more risk protection than studies in which unidentifiable summary statistics are collected. The expert on legal, privacy and ethical issues can advise on taking measures fitting the type of data of interest.
Here, relevant texts researchers must comply with whenever they seek to obtain consent from the participants envisaged in their study, are included.