Grounds for Processing and Informed Consent

Grounds for Data Processing 

There are a number of legal grounds available for research processing.  The main grounds that researchers and recruiters are likely to use are:

• Legitimate interest – legitimate interest can be used if data subjects (participants) have a reasonable expectation that their data will be collected in this way and by doing so the rights of the data subjects are being respected.  This is less likely to be used in research recruitment but might be used for other types of research processing.
• Research exemption and public interest – these may also apply particularly for social research projects.  These conditions have quite specific technical requirements and these should be communicated to you by your client if you are being asked to use these grounds for processing
• Consent – must be freely given, specific, informed and unambiguous. This is achieved by providing a clear statement or by a clear affirmative action signifying agreement to personal data being processed.
• There are some important characteristics regarding consent:
  
  

o    Consent is not forever and can be withdrawn at any time

o    Consent will not be valid unless separate consents are obtained for different processing activities

o    Forced consent (sometimes called ‘omnibus’ consents) is not valid – no pre-ticked boxes or assuming inactivity non-response implies consent

o    Explicit consent is required for the collection of sensitive special category data

• Further processing – you can use personal data collected for another purpose for a research purpose if this is compatible with the original data processing purposes.  This will be determined by:
  
  

o    Link between the original and proposed purpose e.g. personal data collected during a purchase (original purpose) to be used to undertake customer satisfaction research (new research purpose) would be a compatible purpose

o    Context in which the personal data was collected

o    The nature of the personal data

o    The consequences of the additional proposed processing

o    The existence of safeguards (such as data being pseudonymous)

Informed consent is defined as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.  What this means is that research participants, in the case of research, are given a genuine choice and control over how you use their data. If a participant has no real choice, consent is not freely given and it will be invalid.

You need to be transparent during recruitment, ensuring that individuals approached to participate in research have a clear and unambiguous understanding of the purpose/s for collecting their data, how it will be kept, how long and how it will be used. At the time that the data is collected, individuals must give their consent to their data being collected, for what purpose and also at this time, have the opportunity to opt out of any subsequent uses of the data. Consent should be recorded in a verifiable format. Data collected should only then be used in accordance with the permissions gained during data collection.

Researchers must obtain consent for each separate processing activity as bundled consents are not valid. You must get consent for initial research, any re-contact and any recordings or use of photos for research or other purposes. Individuals have the right to withdraw their consent and should be informed of this right prior to giving their consent. Written, electronic and oral consent are all valid but consent must always be verifiable in order to demonstrate that consent was legitimately obtained. Robust records must be kept by recruiters of all consents obtained, demonstrating who consented, when they consented, what they were told, how they consented, whether they have withdrawn consent and if so when. Include:

• The purpose of the recruitment
• The location, time and duration of the activity
• The type of client research e.g. group, depth, paired depth, in-home interview etc
• The monitoring, observation or recording arrangements
• The incentives and how and when they will be paid
• Any other activity involved in the research pre- or post-task
• Any re-contact arrangements which can be for the purposes of that project only

To meet the minimum informed consent requirements when collecting personal data you must supply the following information:

• data controller(s) identity (which might be you, the research agency or the client - or a combination of all three of you) and contact details for the controller/s –research agency and client where joint controllers and preferably allowing for different channels of communication (e.g. phone, email and postal address)
• purpose of each processing activity that consent is being sought for
• type of data to be collected and  if special category data will be collected
• existence of the right to withdraw consent
• information about the use of the data for decisions based solely on automated processing, including profiling
• possible risks of data transfers to third countries in absence of decision or appropriate safeguards