...
This step provides guidance on creating in setting up an Informed Consent Form (ICF) and a Subject Information Sheet (SIS) that align with the FAIR principles. It assumes you are aware of whether your study falls under the WMO (Medical Research Involving Human Subjects Act). If you are unsure, visit the CCMO website, consult the ELSI Servicedesk (available in Dutch) or seek assistance from your local experts
...
IC is an essential component for collecting and reusing data. To ensure an IC complies to laws and regulations it has to be checked. Research that falls under the WMO must undergo a review by an accredited Medical Research Ethics Committees (MREC) or the Central Committee on Research Involving Human Subjects (CCMO). Non-WMO studies are should be reviewed by an ethical committee, such as an MREC. Research is not allowed to start without a positive decision of the approriate appropriate reviewing committee.
If your study is subject to the WMO go to Step 1 and for a non-WMO study go to Step 2. Step 3 describes additional paragraphs relevant for FAIR, which you could consider for your ICF and SIS. In Step 4, issues you may encounter in specific cases are highlighted,for example, when you’re setting up a cohort study.
Note: while this guidance aims to provide up-to-date and accurate information, you should always check with your local privacy and legal specialists! Also, where examples are provided, always check the actual templates to ensure you have the most up-to-date information.
Step 1 - Study is subject to WMO
...
Subject Information Sheet (SIS)
The CCMO’s SIS has the following item relevant for FAIR:
...
Here, it is crucial that the researcher clearly explains the potential purposes for which collected data or materials may be reused. While these purposes can be broader than the original study's aim, they should not be overly vague. For instance, "cancer research" might be acceptable, but "any research" would not. If stored data/material is used for a different purpose, participants must give permission again or usage is not permitted.
Informed Consent Form (ICF)
The CCMO’s SIS contains an ICF as an Appendix. The following items are relevant for FAIR:
...
The CCMO’s SIS model for children does not contain these FAIR items. Hence, to support reuse of this data, add the information from the adult versions to your SIS and ICF before subjecting the and then consult your local experts, such as the data protection / privacy officer, for exact integration before subjecting the documents for review . (?????)
Next
Go to Step 3.Step 2 - Study is not subject to WMO
...
Subject Information Sheet (SIS)
In English, the SIS needs information concerning the following topics:
...
Add the applicable sections to your SIS to ensure it allows for FAIR usage of data and materials.
Informed Consent Form (ICF)
In English, the ICF needs to include the following:
...
If the MREC requires you to use a specific SIS/ICF template for children, check whether it contains FAIR components. If not, consider reusing the entries described above .
Next
Go to Step 3.
Step 3 and consult your local experts, such as the data protection / privacy officer, for exact integration before subjecting the documents for review .
Step 3 - Additional FAIR consideration
Sources:
...
The information below is translated from Dutch templates (sources: Amsterdam UMC: E1E2. Niet-WMO model informatiebrief met toestemmingsformulier versie d.d. 15-08-2024
...
and standardised text van de ELSI Servicedesk). If you decide to use these passages, please verify with your local experts.
<Todo: vertaal>
3.1 Sharing data with parties outside of the EU
...
3.2 Sharing data with commercial parties
Subject Information Sheet
(Gebaseerd op de vorige, waarschijnlijk niet goed…………) → weghalen, omdat we amsterdam umc al hebben?
In this study, your data [and biological material] may be shared with commercial parties for research purposes, such as [explain the reason here]. It is also possible that the data will be shared with commercial entities for the development of new products or services.
We only share your data [and biological materials] with commercial parties if they handle your data [and biological materials] securely and in accordance with the same standards required for researchers within the EU. We will also make written agreements with them to ensure your privacy and the protection of your data.
Informed Consent Form
Ik geef wel/geen (doorhalen wat niet van toepassing is) voor onderzoek met mijn gegevens en materiaal door commerciële partijen.
Amsterdam UMC
Subject Information Sheet
...
Subject Information Sheet
Wordt niet genoemd in de PIF…
Informed Consent Form
...
No template text currently available?
Binnen AOCR gekoppeld met o.a. PALGA. Dus even kijken wat we daar hadden staan en dat misschien herbruiken?
Informed Consent Form
Ik geef wel/geen (doorhalen wat niet van toepassing is) toestemming voor [het koppelen met / opvragen van] mijn gegevens uit [naam database].
...
3.5 Hoe lang bewaren we uw gegevens?
Let op dat er vaste retentieperiodes zijn voor het type onderzoek. Je bent verplicht om je aan de termijn die in je IC staat te houden, ook voor publicaties.
Amsterdam UMC
Subject Information Sheet
...
Ik geef toestemming om mijn lichaamsmateriaal nog [aantal] jaar na dit onderzoek te bewaren. Mogelijk kan dit later nog voor ander/meer onderzoek worden gebruikt, zoals in de informatiebrief staat.
Next
Go to Step 4 .Step 4 - Special cases
4.1 Cohort studies
...
If data is anonymised, it is no longer considered personal data under regulations like the GDPR.
Step 4 5 - Finally
With your SIS and ICF fully FAIR ready and (checked/approved?) by your data protection officer, get it reviewed by the appropriate committee:
An accredited MREC for Non-WMO studies (tbd)
An accredited MREC or the CCMO for WMO studies
Informed Consent Research Roadmap Amsterdam UMC
Opmerking Meriem 24-10-2024: {
Informed Consent Research Roadmap Amsterdam UMCHet zou fijn zijn als er niet alleen een concreet overzicht komt van welke typen consent er zijn (informed consent, opt-in, opt-out, overige vormen) en wanneer welke vorm ingezet zou moeten worden (met concrete voorbeelden), maar ook concrete voorbeelden van wanneer consent niet nodig is. Dus bijvoorbeeld bij preklinisch onderzoek, dieronderzoek, onderzoek met data of materialen van mensen die al overleden zijn. En wat zijn de uitzonderingen? Een voorbeeld van een uitzondering bij gebruik van data van mensen die al overleden zijn, is als het onderzoek ook nog een impact kan hebben op de naasten van de overleden persoon.
In de metroline staat het volgende: In some exceptional cases, you are legally allowed to perform scientific research without a consent. More information about this can be found at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk.
Maar bij mij werkt de link niet.Bij ‘Who can help me at my UMC’ kan voor Amsterdam UMC in ieder geval alvast ingevuld worden dat dit de afdeling Privacy Bescherming & Informatie Beveiliging (privacy@amsterdamumc.nl) is.
De CCMO heeft verschillende typen templates voor informed consent. Ik zag laatst dat hergebruik in het template voor de leeftijd 12-16 niet is meegenomen. Ik weet niet of dat te maken heeft met wetten rondom om privacybescherming van minderjarigen oid. Onderzoekers zouden bij dit template zelf iets moeten toevoegen over hergebruik en dat laten goedkeuren door een METC/Privacy afdeling. Misschien dat hier ook voorbeeld zinnen of paragrafen gegeven kunnen worden die al eerder zijn goedgekeurd. Er zijn wel voorbeelden voor hergebruik in het consentformulier, maar er zijn geen voorbeelden van hoe je dit voor kinderen van 12-16 jaar zou moeten beschrijven in de informatiebrief of bespreekblad (zie ook Subject information, informed consent and informed consent procedure | Onderzoekers | Centrale Commissie Mensgebonden Onderzoek (ccmo.nl)).
Is er een verschil in consent voor bijvoorbeeld cohortstudies? Of wat zijn oplossingen voor cohortstudies die al jaren lopen (denk 30-40 jaar) en het originele consent de lading van hergebruik niet meer dekt? Binnen de Amsterdam Cohort Hub zijn hier ook al werkgroepen die hieraan werken. Quint Olislager (q.olislagers@amsterdamumc.nl) houdt zich hier volgens mij mee bezig.
Hoe zit het met consent wanneer er gebruik is gemaakt van bestaande data en de onderzoeker dus niet zelf in de hand heeft of deze hergebruikte data opnieuw uitgegeven mag worden?
Het delen van queries die gebruikt zijn om de dataset te creëren. Anderen zouden in theorie dezelfde queries moeten kunnen gebruiken bij de originele bron om dezelfde dataset te creëren.
De deelnemers zelf nog benaderen (als daar toestemming voor is gegeven) om consent voor hergebruik af te nemen.
Wat moet er in een Data Sharing Agreement worden meegenomen zodat je zelf kan voldoen aan de FAIR richtlijnen?
Bij extracties uit het Elektronisch Patiënt Dossier kun je in principe een opt-out gebruiken, maar met een opt-out heb je geen expliciete toestemming voor hergebruik. In dit geval moeten de patiënten ook benaderd worden (waar mogelijk) om expliciete toestemming voor hergebruik te geven.
En hoe zit dit bij hergebruik van fysieke materialen? Kunnen de afgeleide digitale data vrij gedeeld worden? Wat moet hiervoor worden afgesproken/ingericht in specifieke situaties?
Publicatie van data: deelnemers kunnen expliciet consent geven voor hergebruik, maar in het ICF staat ook beschreven hoe lang de data bewaard zal worden. Bij publicatie heb je dus ook de plicht om de data van het platform te verwijderen wanneer de wettelijke retentie periode is afgelopen. Wat moet hiervoor worden ingericht?
Is het mogelijk om de data als anoniem te maken beschouwen wanneer bijvoorbeeld het subject ID-log is vernietigd? Zijn er extra pseudonimisatiestappen nodig en mag de data dan wel op een platform blijven staan?
[Sander / Miriem]
Question: what is specific information that should be in your IC to accomodate for FAIR data and its further usage. IC information concerning secondary use of data / materials, potential data linkage to external registries (e.g. PALGA, IKNL)?
Step-wise how about something like:
Check your institute for an IC template
Miriem: Zou hier niet ook verwezen moeten worden naar de CCMO templates: Subject information, informed consent and informed consent procedure | Onderzoekers | Centrale Commissie Mensgebonden Onderzoek (ccmo.nl)
Check whether it allows for “whatever it is we need for making this data FAIR and its sharing”
I know there are factors which depend on the study, like e.g. linkage with PALGA, IKNL, etc.
Does this depend on FAIR Objectives? Does “I want to publish the study in the HRI Catalogue” require something different in an IC than “I want to use a patient’s data for federated querying?”
Miriem: Meestal moet er voor gezondheidsdata een data sharing agreement opgezet worden. Binnen het informed consent wordt de context van de dataverzameling beschreven en mag data binnen eenzelfde context gedeeld worden (indien er toestemming is gegeven voor data delen). Dit betekent dat er voor iedere data aanvraag gecontroleerd moet worden of de doelen voor het gebruik overeenkomen met de doelen die beschreven staan in het informed consent.
Het is nog wel een idee om hier iemand met kennis van wetgeving naar te laten kijken.
Sander: The first, I want to publish the study in the HRI Catalogue, doesn’t require anything special in the IC I think? Only when the data owner actually wants to share your data does the IC become relevant?
Meriem: De metadata over welke gegevens er zijn verzameld mogen vrij gedeeld worden (tenzij dit mogelijk valt onder geheimhouding vanwege mogelijke patenten oid). Maar ook hier zou ik iemand met meer kennis over het opzetten van (DSA) contracten naar laten kijken. Zij kunnen misschien meer toevoegen over de uitzonderingen.
Sander: Is “sharing” by sending someone the data and “sharing via federated querying” different? If federated querying is anonymous by default, since the data never leaves a center, does IC about sharing the data still matter?
Meriem: Ik weet niet of federated querying by default anoniem is. Volgens mij kan deze data nog steeds gepseudonimiseerd zijn. Daarom moet er nog steeds een goede infrastructuur worden opgezet waarbij de bescherming van persoonsgegevens gewaarborgd kan worden.
Federated querying is a method of querying and accessing distributed datasets without physically centralizing the data. In the healthcare context, federated querying allows researchers, clinicians, or data scientists to access and analyze health data across multiple systems (e.g., hospitals, research institutions) without transferring sensitive patient data to a central location.
When sharing or accessing health data via federated querying, compliance with the GDPR is crucial, particularly because health data is classified as special category data under Article 9 of the GDPR. Health data includes information such as medical history, diagnosis, treatment, and genetic data. Key GDPR principles relevant to federated querying include:Lawfulness, Fairness, and Transparency
Lawful Basis for Processing: You must have a lawful basis to access or share health data, such as explicit consent from the data subject, or processing for research purposes under Article 9(2)(j).
Transparency: Data subjects must be informed about how their data is used, even if it’s queried remotely. Transparent data-sharing policies and consent mechanisms are essential.
Data Minimization and Purpose Limitation
Minimization: The GDPR requires that only the data necessary for the specific purpose is accessed or processed. In federated querying, this means limiting access to the minimum amount of data required to answer the query.
Purpose Limitation: Health data accessed through federated queries must only be used for the specific purpose (e.g., research) for which it was originally collected, and not for secondary purposes unless additional consent is obtained or a legal basis exists.
Data Security and Confidentiality
Security of Processing: Federated querying must implement robust technical and organizational measures to secure health data. This includes encryption, anonymization, pseudonymization, and access controls to prevent unauthorized access.
Data Localization: Since data remains on local servers, federated systems reduce the risks associated with transferring health data, but the data controllers (entities holding the data) must ensure secure query execution and auditability.
Accountability and Governance
Data Controllers and Processors: Each institution participating in a federated querying system is likely to act as a data controller, responsible for ensuring GDPR compliance. Federated systems often require detailed Data Processing Agreements (DPAs) between the entities to govern how data is accessed and used.
Data Protection Impact Assessments (DPIAs): If federated querying involves high-risk processing of health data, organizations may need to conduct a DPIA to assess risks and ensure GDPR compliance.
Make sure the necessary lines are in the IC
Get the IC approved
[Meriem]
When sharing or linking health data with external registries (e.g., disease-specific databases, national health registries, or international research databases), the informed consent process must clearly define:
What data will be shared or linked: The type and nature of the health data (e.g., genetic data, medical history, treatment outcomes) that will be shared or linked with external registries.
Who the data will be shared with: This includes identifying the external registries, research institutions, or third parties that will have access to the data.
Purpose of data sharing/linking: The consent form should explicitly state the research purposes for which the data will be shared, such as epidemiological research, clinical studies, or public health monitoring.
Data security and anonymisation/pseudonymisation: Participants should be informed about how their data will be protected, whether the data will be anonymised or pseudonymised, and what security measures are in place during data sharing.
Step 0 - Determine whether your study is subject to the WMO
Determine whether your study is subject to the Medical Research Involving Human Subjects Act (WMO) or not. The Central Committee on Research Involving Human Subjects (CCMO) executes the WMO and the Embryo’s Act. Research that falls under the WMO or the Embryo’s Act must undergo a review by an accredited Medical Research Ethics Committees (MREC) or the CCMO. Research is not allowed to start without a positive decision of this committee.
Research is subject to the WMO if the following criteria are met:
It concerns medical scientific research and
Participants are subject to procedures or are required to follow rules of behaviour.
To learn more, contact your local experts, see the CCMO website or the ELSI Servicedesk (in Dutch).
Multi-center IC?
FAIRopoly
The development of this ICF benefited from previous experience with ICF submissions by 4 ERN Registries (ERKReg, EuRRECa, ENROL, VASCA) and from the utilization of “machine-readable” consent-related Ontologies (Data Use Ontology and Informed Consent Ontology). Several iterative expert reviews (including patient organizations and ERN representatives) were conducted to finalize the ICF.
Some potential sources:
ELSI Servicedesk? Unfortunately in Dutch.
Templates for ICs?
https://book.the-turing-way.org/project-design/sdpm/informed.html
[HANDS] - chapter privacy and autonomy
Consent
Consent aims at informing potential study subjects of all aspects of participation, including the procedures for data handling, data access and anonymity. An informed person can freely decide to participate or not. If someone does participate, he or she understands and accepts the risks and burdens involved in participation.
The Central Committee on Research Involving Human Subjects (CCMO) has produced guidelines for obtaining informed consent and has adapted the nationally mandatory proefpersonen-informatieformulier in light of the GDPR (for WMO research). In addition, the NFU working group ‘Privacy, ethiek & recht in gezondheidsonderzoek’ is currently developing a UMC format for broad consent, which may be applicable to certain non-WMO research. Advice on how to inform donors and patients about the use of their biomaterials and/or data in scientific research can be found at the ELSI servicedesk.
The ethical committee at your UMC can help you design your informed consent procedure. Regarding data management, the informed consent should include the person's wishes about:
the use and reuse of patient data for research in the current and future projects;
notification about the research results, including incidental research findings (special concern is required for results that cannot be interpreted now, but may be interpretable in the near future);
which data he/she can access, if applicable;
the possibility to withdraw certain aspects of informed consent and the consequences;
data use by commercial parties.
Consent should be documented along with the collected data, so subsequent users of the data are aware of the conditions agreed to by study subjects.
In general, it is very difficult to re-contact patients or study subjects to extend or change the consent. So, we advise you to obtain informed consent for storing clinical and personal data for the purpose of both healthcare and future scientific research, each with a separate specific informed consent (also see: care and research environment). In addition, patients should always be able to retract their consent.
Frequently Asked Questions
What does the EU General Data Protection Regulation state about consent?
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
And, regarding broad consent for scientific research: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”
When and with what procedure should patients give consent for the use of their data or biomaterial for scientific research?
This is described at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk.
What if it is impossible to ask for consent?
In some exceptional cases, you are legally allowed to perform scientific research without a consent. More information about this can be found at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk. Always minimise the data and specifically describe the arguments for not asking for consent and make sure that your institute or its Data Protection Officer has accepted your arguments, before you start your research.
Do I need informed consent to use anonymous data?
Informed consent is not mandatory if your data is truly anonymous. However, you should carefully consider whether your data indeed is anonymous: it may be possible to trace ‘anonymous’ data to an individual person by combining the data with other data sources. You should always be aware of this possibility when sharing your data with third parties. It is advisable to let an independent party (for instance a Data Access Committee or Board) objectively assess your proposed data sharing.
What does my institute need to do to inform patients?
Your institute needs to actively inform patients that they may be asked to participate in scientific research. Also, they should be informed that in some exceptional cases, it can legally be allowed to perform scientific research without a consent. Patients are offered the right to refuse to such use. Your institute needs to install a procedure to ensure that such refusals are followed through, i.e., if people have refused sharing their data for scientific research, these data should not be used in research.
What about genetic data?
The EU General Data Protection Regulation states that ‘Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.’
Most genetic studies will involve restricted access to individual level genotype and phenotype due to privacy concerns that are associated with this type of data.
The ELSI Servicedesk answers the question to what extent the data from whole genome sequencing are regarded as (directly) identifying. Also it advises on whether an informed consent form should state that genetic data is being processed.
Who can help me at my UMC?
Use the Toolbox to find support on informed consent at your UMC.
Further reading
For more information on incidental findings, please take a look at the BBMRI publication: Handreiking voor het constateren van, omgaan met en informeren over nevenbevindingen voor biobanken in BBMRI-NL.
A general informed consent form may be available, but a local Institutional Ethical Review Board may demand changes after reviewing. It is crucial that essential data sharing aspects are explicitly handled in the informed consent form [De Novo]. The consent information should be made available as metadata.
IC is also vital for GDPR compliance, as processing personal data (especially sensitive health data) often requires explicit consent from the data subject. Furthermore, patient consent is necessary for, for example, archiving, sharing [uu_consent] and linkage with external registries.
A general informed consent form is available on the website of the CCMO, but a local Institutional Ethical Review Board may demand changes after reviewing and assesses whether the IC aligns with ethical standards, legal requirements and takes considerations into account such as age. This is important because:
It ensures that the consent form is written in a way that participants in that particular region can understand.
The local committee will assess whether the consent form adequately explains the data processing activities, the purpose of data collection, and participants' rights (e.g., the right to withdraw consent).
The committee ensures that the study adheres to local regulations regarding the use of personal and sensitive health data.
[uu_consent] https://www.uu.nl/en/research/research-data-management/guides/informed-consent-for-data-sharing
...
Expertise requirements for this step
...