Introduction

In the early stages of a data donation study, the researcher should work towards submission to an Ethical Review Board (ERB) in order to obtain ethical approval. To guide a researcher in this process, consulting a legal expert is recommended. The exact process of obtaining ethical approval differs over academic institutions. Hence, it is advised to get in contact with legal experts of the institute early in the process. Despite these possible differences over institutions, a privacy policy and consent form are always required. In case personal data is being collected, a Data Protection Impact Assessment (DPIA) is also required. A solid worked out idea of the study design, local extraction script, where the data donation software is hosted and where data is stored provide the required information to prepare this.

Prior to participation in any research, human subjects or participants have to provide informed consent (Falagas et al., 2009; Neff, 2008). This usually is done by signing a consent form after being provided with thorough information on the concerning study. At least the participant should be informed on:

  • the researcher’s identity
  • the data being collected and what data is being used
  • the purpose of any data processing step
  • the existence of the right to withdraw consent
  • confidentiality protection and the limitations thereof
  • time and nature of data storage

Depending on the study population and type of data being collected, additional information might have to be provided as well. The legal expert should guide the researcher and ensure that participants are provided with all required information. Participants should be able to access this information at any moment during the study. Ensuring this continuous access can be attained by providing participants with a privacy policy, summarizing all required information on the rights of participants and potential risks of the study.

You can find a template of a consent form here, and a template of a privacy policy here.

Data protection impact assessment

A data protection impact assessment (DPIA) is expected or even mandatory to be carried out in every situation where personal data is collected or processed. Hence, for data donation studies a DPIA will always be required. A DPIA is documentation in which is described exactly how data will be collected, processed and stored (Demetzou, 2019; Hoofnagle et al., 2019).

Furthermore, in a DPIA the researcher needs to reflect on situations in the data handling process where privacy of participants potentially could be violated. They need to argue how they minimize these potential risks. The DPIA mainly concerns the steps in the workflow of constructing the extraction script and configuring the data donation tool. The DPIA should be adjusted to the type of data that is collected in the study. Studies with data collection on sensitive topics require more risk protection than studies in which unidentifiable summary statistics are collected. The expert on legal, privacy and ethical issues can advise on taking measures fitting the type of data of interest.

Here, you can find an extensive manual that explains how consent is arranged in the GDPR, and that provides templates for a consent form and privacy policy for a data donation study.and here

Here, relevant texts researchers must comply with whenever they seek to obtain consent from the participants envisaged in their study, are included.