Consent under GDPR (visit our GDPR webpage) means “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. Consent may be provided by the data subject in written, electronic or oral format.
Data controllers must be able to demonstrate that the data subject has consented to the processing of his/her data. Therefore, records will need to be kept so that a data subject’s consent can be verified. Requests for consent must be in intelligible and easily accessible formats, using clear and plain language. The Article 29 Working Party (Art. 29 WP), an advisory body that provides expert advice to the EU Member States regarding data protection has provided the following guidance on consent. Thus, consent (also referred to as explicit consent) should specifically refer to:
- The particular data set that is to be processed
- The precise purpose of processing (including any automated decision-making)
- Should identify any risks and/or implications that might arise for the data subject as a result of the data processing
- Should provide any other relevant and specific information that might influence the decision of a data subject to give or not give their consent.
The HRB has outlined conditions for consent, explicit consent and broad consent. The Department of Health has also issued principles for informed consent in health research; see their document at the end of this page.
The Assisted Decision Making (Capacity) Act 2015 was signed into law in December 2015. This Act applies to everyone and is relevant to health and social care services. The Act supports decision making and maximizes people’s capacity to make decisions. The Act has not yet been commenced. However, the HSE is doing a number of things to prepare staff and services for commencement.
Health Research Consent Declaration Committee
Despite the best efforts of researchers, it may not always be possible to get explicit consent but researchers must be able to demonstrate that they have made significant efforts to obtain consent. It may be that the public interest of the research significantly outweighs the public interest in requiring the explicit consent of the individual whose data is being processed (Regulation 5(1)).
A consent declaration is a declaration made by the Health Research Consent Declaration Committee (HR-CDC) that the explicit consent of the data subject is not required. A full description of how the HR-CDC was formed, its underpinning legislation, its members, how to get in touch with its Secretariat staff, the latest news on the Health Research Regulations, application forms and how to apply to the HR-CDC are on its website (https://hrcdc.ie/).