...
Short description
‘A great quite’ quote’ (source)
Informed consent (IC) is the process by which a patient voluntarily agrees to a medical procedure, treatment, or participation in research after being fully informed about the relevant details. Obtaining patients’ informed consent for is usually required when collecting their data for scientific purposes is usually required [De novo]. Furthermore, patient consent may be necessary for, for example, sharing and archiving and sharing [uu_consent] of the data and linkage with e.g. external registries. Furthermore, consent information is necessary for
For the data to be machine-actionable, as without such data allowing automated systems or software to interpret, process, and take predefined actions on it without human intervention, the IC information must be provided in a digital, standardised fashion, as without such information a computer cannot know whether it is allowed to use the data [FAIR].
A general informed consent form may be available, but a local The image below highlights some variants of informed consent and how they are (generally) related.
-20241115-081851.png?version=1&modificationDate=1731658744447&cacheVersion=1&api=v2&width=1800)
Depending on the type of study and the goals, specific rules for the allowed form of consent can exist. For example, an invasive study involving human subjects need to adhere to the rules set by the CCMO.
A general informed consent form may be available, but a local Institutional Ethical Review Board may demand changes after reviewing. It is crucial that essential data sharing aspects are explicitly handled in the informed consent form [De Novo]. The consent information should be made available as metadata.
[uu_consent] https://www.uu.nl/en/research/research-data-management/guides/informed-consent-for-data-sharing
SdR: The step is call Obtain informed consent. Can you “obtain” IC with an opt-out model?
Do we want to mention things like dynamic IC, electronic IC, Toestemming aan de poort?
Why is this step important
A properly designed informed consent is crucial for data reuse. Without it, archiving, sharing, etc may not be possible.
How to
[Sander]
Question: what is specific information that should be in your IC to accomodate for FAIR data and its further usage. IC information concerning secondary use of data / materials, potential data linkage to external registries (e.g. PALGA, IKNL)?
Step-wise how about something like:
Check your institute for an IC template
Check whether it allows for “whatever it is we need for making this data FAIR and its sharing”
I know there are factors which depend on the study, like e.g. linkage with PALGA, IKNL, etc.
Does this depend on FAIR Objectives? Does “I want to publish the study in the HRI Catalogue” require something different in an IC than “I want to use a patient’s data for federated querying?”
The first doesn’t require anything special in the IC I think? Only when the data owner actually wants to share your data does the IC become relevant?
Is “sharing” by sending someone the data and “sharing via federated querying” different?
If federated querying is anonymous by default, since the data never leaves a center, does IC about sharing the data still matter?
Make sure the necessary lines are in the IC
Get the IC approved
FAIRopoly
The development of this ICF benefited from previous experience with ICF submissions by 4 ERN Registries (ERKReg, EuRRECa, ENROL, VASCA) and from the utilization of “machine-readable” consent-related Ontologies (Data Use Ontology and Informed Consent Ontology). Several iterative expert reviews (including patient organizations and ERN representatives) were conducted to finalize the ICF.
Some potential sources:
...
ELSI Servicedesk? Unfortunately in Dutch.
...
Templates for ICs?
...
...
...
https://rdmkit.elixir-europe.org/human_data
...
https://rdmkit.elixir-europe.org/ethics
...
https://book.the-turing-way.org/project-design/sdpm/informed.html
[HANDS] - chapter privacy and autonomy
Consent
Consent aims at informing potential study subjects of all aspects of participation, including the procedures for data handling, data access and anonymity. An informed person can freely decide to participate or not. If someone does participate, he or she understands and accepts the risks and burdens involved in participation.
The Central Committee on Research Involving Human Subjects (CCMO) has produced guidelines for obtaining informed consent and has adapted the nationally mandatory proefpersonen-informatieformulier in light of the GDPR (for WMO research). In addition, the NFU working group ‘Privacy, ethiek & recht in gezondheidsonderzoek’ is currently developing a UMC format for broad consent, which may be applicable to certain non-WMO research. Advice on how to inform donors and patients about the use of their biomaterials and/or data in scientific research can be found at the ELSI servicedesk.
The ethical committee at your UMC can help you design your informed consent procedure. Regarding data management, the informed consent should include the person's wishes about:
the use and reuse of patient data for research in the current and future projects;
notification about the research results, including incidental research findings (special concern is required for results that cannot be interpreted now, but may be interpretable in the near future);
which data he/she can access, if applicable;
the possibility to withdraw certain aspects of informed consent and the consequences;
data use by commercial parties.
Consent should be documented along with the collected data, so subsequent users of the data are aware of the conditions agreed to by study subjects.
In general, it is very difficult to re-contact patients or study subjects to extend or change the consent. So, we advise you to obtain informed consent for storing clinical and personal data for the purpose of both healthcare and future scientific research, each with a separate specific informed consent (also see: care and research environment). In addition, patients should always be able to retract their consent.
Frequently Asked Questions
What does the EU General Data Protection Regulation state about consent?
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
And, regarding broad consent for scientific research: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”
When and with what procedure should patients give consent for the use of their data or biomaterial for scientific research?
This is described at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk.
What if it is impossible to ask for consent?
In some exceptional cases, you are legally allowed to perform scientific research without a consent. More information about this can be found at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk. Always minimise the data and specifically describe the arguments for not asking for consent and make sure that your institute or its Data Protection Officer has accepted your arguments, before you start your research.
Do I need informed consent to use anonymous data?
Informed consent is not mandatory if your data is truly anonymous. However, you should carefully consider whether your data indeed is anonymous: it may be possible to trace ‘anonymous’ data to an individual person by combining the data with other data sources. You should always be aware of this possibility when sharing your data with third parties. It is advisable to let an independent party (for instance a Data Access Committee or Board) objectively assess your proposed data sharing.
What does my institute need to do to inform patients?
Your institute needs to actively inform patients that they may be asked to participate in scientific research. Also, they should be informed that in some exceptional cases, it can legally be allowed to perform scientific research without a consent. Patients are offered the right to refuse to such use. Your institute needs to install a procedure to ensure that such refusals are followed through, i.e., if people have refused sharing their data for scientific research, these data should not be used in research.
What about genetic data?
The EU General Data Protection Regulation states that ‘Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.’
Most genetic studies will involve restricted access to individual level genotype and phenotype due to privacy concerns that are associated with this type of data.
The ELSI Servicedesk answers the question to what extent the data from whole genome sequencing are regarded as (directly) identifying. Also it advises on whether an informed consent form should state that genetic data is being processed.
Who can help me at my UMC?
Use the Toolbox to find support on informed consent at your UMC.
Further reading
For more information on incidental findings, please take a look at the BBMRI publication: Handreiking voor het constateren van, omgaan met en informeren over nevenbevindingen voor biobanken in BBMRI-NL.
The How to section should:
...
be split into easy to follow steps;
Step 1
Step 2
etc.
...
help the reader to complete the step;
...
aspire to be readable for everyone, but, depending on the topic, may require specialised knowledge;
...
be a general, widely applicable approach;
...
if possible / applicable, add (links to) the solution necessary for onboarding in the Health-RI National Catalogue;
...
aim to be practical and simple, while keeping in mind: if I would come to this page looking for a solution to this problem, would this How-to actually help me solve this problem;
...
contain references to solutions such as those provided by FAIR Cookbook, RMDkit, Turing way and FAIR Sharing;
...
IC is also vital for GDPR compliance, as processing personal data (especially sensitive health data) often requires explicit consent from the data subject. Furthermore, patient consent is necessary for, for example, archiving, sharing [uu_consent] and linkage with external registries.
A general informed consent form is availableon the website of the CCMO, but a local Institutional Ethical Review Board may demand changes after reviewing and assesses whether the IC aligns with ethical standards, legal requirements and takes considerations into account such as age. This is important because:
It ensures that the consent form is written in a way that participants in that particular region can understand.
The local committee will assess whether the consent form adequately explains the data processing activities, the purpose of data collection, and participants' rights (e.g., the right to withdraw consent).
The committee ensures that the study adheres to local regulations regarding the use of personal and sensitive health data.
It is crucial that essential data sharing aspects are explicitly handled in the informed consent form [De Novo]. The consent information should be made available as metadata.
[uu_consent] https://www.uu.nl/en/research/research-data-management/guides/informed-consent-for-data-sharing
[uu_consent] https://www.uu.nl/en/research/research-data-management/guides/informed-consent-for-data-sharing
SdR: The step is call Obtain informed consent. Can you “obtain” IC with an opt-out model?
Do we want to mention things like dynamic IC, electronic IC, Toestemming aan de poort?
Does a PIF also contain information about data collection / how data will be used? Or is the PIF only medical?
Why is this step important
The FAIR principles encourage making data more useful for both immediate research purposes and future secondary purposes, such as replication, validation and meta-analysis, while still protecting participants' privacy and rights. To accommodate for the FAIR data principles in the Informed Consent (IC) for health research data, the IC must include specific information that addresses both the immediate use of the data and its potential future uses in a way that aligns with GDPR requirements.
Current Research Purpose: The IC should clearly explain the primary purpose for which the health data is being collected (e.g., a specific clinical study, disease research, or a longitudinal health survey).
Potential Future Use: To align with the FAIR principles, the IC should also mention the possibility that the data may be used for future research purposes, which may not yet be fully known at the time of data collection. However, the scope of future research should be described as broadly but as clearly as possible, respecting GDPR’s transparency principle.
FAIR Data Goals: The IC should include a statement that aligns with the goals of FAIR data, explaining that the data will be made findable, accessible, interoperable, and reusable by other researchers and stakeholders in the scientific community.
Data Registries or Repositories: If applicable, the IC should state that the data will be deposited into data repositories or registries that adhere to FAIR principles, allowing it to be discoverable and reusable by others.
Who Will Access the Data: Provide clarity on who will be allowed to access the data. This includes mentioning both internal and external researchers and potential data-sharing partnerships.
Controlled vs. Open Access: Explain whether the data will be made available via open access (where anyone can access the data) or via controlled access (where only approved researchers or organizations can access it).
Cross-border Data Transfers: If the data may be shared internationally, the IC must comply with GDPR’s rules on cross-border data transfers. Explain if the data will be shared with researchers outside the EU and what safeguards are in place to protect the data in international transfers.
How to
As explained, informed consent (IC) is an essential component for collecting and reusing data. Research that falls under the WMO (Wet medisch-wetenschappelijk onderzoek met mensen, the Dutch Medical Research Involving Human Subjects Act) must undergo a review by an accredited Medical Research Ethics Committees (MREC) or the Central Committee on Research Involving Human Subjects (CCMO). Non-WMO studies are reviewed by the a MREC. Research is not allowed to start without a positive decision of the reviewing committee.
In this How to, guidance is provided to help you create an Informed Consent Form (ICF) and Subject Information Sheet (SIS) that are compatible with the FAIR principles. This guidance assumes you already know whether your study is subject to the WMO. If you’re uncertain, contact your local experts, see the CCMO website or the ELSI Servicedesk (in Dutch). If your study is subject to the WMO go to Step 1 and for a non-WMO study go to Step 2. In Step 3, some special cases are described.
Note that, while this guidance aims to provide up-to-date and accurate information, you should always check with your local privacy and legal specialists!
Step 1 - Study is subject to WMO
The CCMO has published SIS models for both adults and children and strongly recommends their usage. The models are available in both English and Dutch. The MREC/CCMO reviewing committee only assesses the Dutch SIS and ICF. However, if a participant who is not adequately fluent in Dutch is asked to participate in a study, the information must be provided in a language the participant is proficient in.
Subject Information Sheet
The CCMO’s SIS has the following item relevant for FAIR:
Can we use your data and body material for other research?
Here, it is crucial that the researcher clearly explains the potential purposes for which collected data or materials may be reused. While these purposes can be broader than the original study's aim, they should not be overly vague. For instance, "cancer research" might be acceptable, but "any research" would not. If stored data/material is used for a different purpose, participants must give permission again or usage is not permitted.
Informed Consent Form
The CCMO’s SIS contains an ICF as an Appendix. The following items are relevant for FAIR:
I give consent to store my data to use for other research, as stated in the information sheet.
I give consent to have my (remaining) body material stored for use in other research, as stated in the information sheet. The body material is stored for this purpose for another [xx] years.
Participants < 16 years old (children)
The CCMO’s SIS model for children does not contain these FAIR items. Hence, to support reuse of this data, these items should be added to the SIS and ICF before subjecting the documents for review. (?????)
Additional FAIR considerations
Andere relevante zinnen om toe te voegen? Eventueel als aparte stap als we echt zinnen weten, zodat we daar voor zowel WMO als niet-WMO gebruik van kunnen maken?
Step 2 - Study is not subject to WMO
First, check if your local MREC has a SIS and ICF template that requrie you to use as a basis. Verify whether the templates contain FAIR components. The ELSI Servicedesk provides standardised text that can be used in the SIS and ICF (only available in Dutch).
Subject Information Sheet
In English, the SIS needs information concerning the following topics:
May we use your data <if applicable> [and biomaterial] for other scientific research?
<if applicable> If we collaborate with countries outside the European Union
SdR: dit hierboven is vrij zwak, aangezien het mijn vertaling is. Is het een optie om de inhoud te vertalen naar het Engels en de inhoud of bij ELSI neer te zetten of desnoods hier? Overleggen met Susanne.
SdR: how is the second aspect handled in WMO-studies?
Add the applicable sections to your SIS to ensure it allows for FAIR usage of data and materials.
Subject Information Sheet
In English, without the full explanation, the ICF needs to include the following:
I give consent to use my data <if applicable> [and (residual (remaining?)) biomaterial] for other scientific research, as stated (explained?) in the subject information sheet.
If no template exists, consider using the CCMO template, available in both English and Dutch, as a basis.
To allow for the reuse of data and biomaterial collected in non-WMO studies, the SIS and ICF must properly inform and request consent from the participant. This ELSI Servicedesk page provides more context and contains a link to a standardised text that can be used in the SIS and ICF (only available in Dutch).
Subject Information Sheet
In English, without the full explanation, the SIS needs information concerning the following topics:
May we use your data <if applicable> [and biomaterial] for other scientific research?
<if applicable> If we collaborate with countries outside the European Union
SdR: dit hierboven is vrij zwak, aangezien het mijn vertaling is. Is het een optie om de inhoud te vertalen naar het Engels en de inhoud of bij ELSI neer te zetten of desnoods hier? Overleggen met Susanne.
SdR: how is the second aspect handled in WMO-studies?
Add the applicable sections to your SIS to ensure it allows for FAIR usage of data and materials.
Subject Information Sheet
In English, without the full explanation, the ICF needs to include the following:
I give consent to use my data <if applicable> [and (residual (remaining?)) biomaterial] for other scientific research, as stated (explained?) in the subject information sheet.
SdR: So I guess the collaboration is essential for the project and no consent is asked? If patient doesn’t want this, he/she can’t join the study?
SdR: Wie toetst niet-WMO studies? Lokale METC? Stukje hieronder in dit deel?
Vraag bij de METC welke templates van informed consent worden geaccepteerd. Een ethische commissie mag geen adviezen geven, maar alleen beoordelen of een informed consent voldoet aan alle wettelijke eisen en verplichtingen.
Stel bij Privacy (functionaris gegevensbescherming of privacy officer) vragen over eventuele aanpassingen of toevoegingen van het informed consent.
ELSI website: Binnenkort verschijnt op de ELSI Servicedesk de standaard PIF die otwikkeld is in het project ‘wederzijdse erkenning’ van de NFU. Hier zit ook een hergebruikvraag bij (en meer, ook bv koppelen) voor biobanken. En in het project implementatie nWMO toetsingskader (getrokken door Elyse) wordt ook gewerkt aan een standaard PIF, maar daar moet nog mee gestart worden.
SdR: wat is het verschil tussen die standaard PIFs, waarom komt er meer dan 1 standaard PIF en wanneer moet je welke gebruiken? Hoe kunnen we onderzoekers helpen met het kiezen van de juiste?
Step 3 - Special cases
Cohort studies and biobanks.
Large-scale research with minimal risk.
Research involving animals. Here, informed consent is not applicable in the same way it is for human research. Instead, ethical approval is required to ensure the humane treatment of animals.
Deceased participants. Informed consent is generally not required for the use of data or biological specimens from deceased individuals, provided that the research adheres to ethical guidelines and legal regulations.
Anonymised data. If data is anonymised, it is no longer considered personal data under regulations like the GDPR.
Als er uitzonderingen op zijn, dan doorverwijzen naar de groepen/templates.
Informed Consent Research Roadmap Amsterdam UMC
First, we are assuming you already know whether your study is subject to the WMO or not.
...
Chapter 10
What data do we store?
<if applicable> What body material do we store?
Why do we collect, use and store your data <if applicable> and body material?
How do we protect your privacy?
Who can see your data?
For how long do we store your data and body material?
<if applicable> Can we use your data and body material for other research?
<If applicable> What happens if there are coincidental findings?
Can you take back your consent for the use of your data?
<If applicable> We send your data to countries outside the European Union
Do you want to know more about your privacy?
Where can you find more information about the study?
Susanne: ik ben zelf van harte bereid om deze pagina voor jullie te reviewen. Hergebruik aan de voorkant goed regelen is zeg maar mijn ding ;). Je voorkomt er achteraf een hoop gedoe mee. Tegelijkertijd vind ik het ook heel belangrijk om patienten niet onnodig 10 toestemmingsvragen te stellen. Als een onderdeel (bv koppelen, organoids) een inherent onderdeel van een project is, hoort het allemaal in de hoofd-toestemmingsvraag.
Opt-in, opt-out? What about the PIF?
[Miriem]
Zoals net besproken zou het ook interessant zijn om te kijken naar
Welk type consent heb ik nodig:
Prospectief onderzoek: expliciet informed consent
Retrospectief:
opt-in of opt-out consent: wat is het verschil en wanneer pas je welke toe?
Expliciet consent wanneer je de retrospectieve data ook weer opnieuw zou willen gebruiken of beschikbaar willen stellen: voor hergebruik moet expliciet consent zijn gegeven.
Vraag bij de METC welke templates van informed consent worden geaccepteerd. Een ethische commissie mag geen adviezen geven, maar alleen beoordelen of een informed consent voldoet aan alle wettelijke eisen en verplichtingen.
Stel bij Privacy (functionaris gegevensbescherming of privacy officer) vragen over eventuele aanpassingen of toevoegingen van het informed consent.
Zijn er standaardzinnen of paragrafen die je per onderwerp zou kunnen toevoegen aan een ICF-template?
Toevoegingen over het koppelen van data aan externe registries
Toevoegingen over samenwerkingen met externe partijen, bijvoorbeeld voor opschoning en analyses van de data
Opmerking Meriem 24-10-2024: {
Informed Consent Research Roadmap Amsterdam UMCHet zou fijn zijn als er niet alleen een concreet overzicht komt van welke typen consent er zijn (informed consent, opt-in, opt-out, overige vormen) en wanneer welke vorm ingezet zou moeten worden (met concrete voorbeelden), maar ook concrete voorbeelden van wanneer consent niet nodig is. Dus bijvoorbeeld bij preklinisch onderzoek, dieronderzoek, onderzoek met data of materialen van mensen die al overleden zijn. En wat zijn de uitzonderingen? Een voorbeeld van een uitzondering bij gebruik van data van mensen die al overleden zijn, is als het onderzoek ook nog een impact kan hebben op de naasten van de overleden persoon.
In de metroline staat het volgende: In some exceptional cases, you are legally allowed to perform scientific research without a consent. More information about this can be found at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk.
Maar bij mij werkt de link niet.Bij ‘Who can help me at my UMC’ kan voor Amsterdam UMC in ieder geval alvast ingevuld worden dat dit de afdeling Privacy Bescherming & Informatie Beveiliging (privacy@amsterdamumc.nl) is.
De CCMO heeft verschillende typen templates voor informed consent. Ik zag laatst dat hergebruik in het template voor de leeftijd 12-16 niet is meegenomen. Ik weet niet of dat te maken heeft met wetten rondom om privacybescherming van minderjarigen oid. Onderzoekers zouden bij dit template zelf iets moeten toevoegen over hergebruik en dat laten goedkeuren door een METC/Privacy afdeling. Misschien dat hier ook voorbeeld zinnen of paragrafen gegeven kunnen worden die al eerder zijn goedgekeurd. Er zijn wel voorbeelden voor hergebruik in het consentformulier, maar er zijn geen voorbeelden van hoe je dit voor kinderen van 12-16 jaar zou moeten beschrijven in de informatiebrief of bespreekblad (zie ook Subject information, informed consent and informed consent procedure | Onderzoekers | Centrale Commissie Mensgebonden Onderzoek (ccmo.nl)).
Is er een verschil in consent voor bijvoorbeeld cohortstudies? Of wat zijn oplossingen voor cohortstudies die al jaren lopen (denk 30-40 jaar) en het originele consent de lading van hergebruik niet meer dekt? Binnen de Amsterdam Cohort Hub zijn hier ook al werkgroepen die hieraan werken. Quint Olislager (q.olislagers@amsterdamumc.nl) houdt zich hier volgens mij mee bezig.
Hoe zit het met consent wanneer er gebruik is gemaakt van bestaande data en de onderzoeker dus niet zelf in de hand heeft of deze hergebruikte data opnieuw uitgegeven mag worden?
Het delen van queries die gebruikt zijn om de dataset te creëren. Anderen zouden in theorie dezelfde queries moeten kunnen gebruiken bij de originele bron om dezelfde dataset te creëren.
De deelnemers zelf nog benaderen (als daar toestemming voor is gegeven) om consent voor hergebruik af te nemen.
Wat moet er in een Data Sharing Agreement worden meegenomen zodat je zelf kan voldoen aan de FAIR richtlijnen?
Bij extracties uit het Elektronisch Patiënt Dossier kun je in principe een opt-out gebruiken, maar met een opt-out heb je geen expliciete toestemming voor hergebruik. In dit geval moeten de patiënten ook benaderd worden (waar mogelijk) om expliciete toestemming voor hergebruik te geven.
En hoe zit dit bij hergebruik van fysieke materialen? Kunnen de afgeleide digitale data vrij gedeeld worden? Wat moet hiervoor worden afgesproken/ingericht in specifieke situaties?
Publicatie van data: deelnemers kunnen expliciet consent geven voor hergebruik, maar in het ICF staat ook beschreven hoe lang de data bewaard zal worden. Bij publicatie heb je dus ook de plicht om de data van het platform te verwijderen wanneer de wettelijke retentie periode is afgelopen. Wat moet hiervoor worden ingericht?
Is het mogelijk om de data als anoniem te maken beschouwen wanneer bijvoorbeeld het subject ID-log is vernietigd? Zijn er extra pseudonimisatiestappen nodig en mag de data dan wel op een platform blijven staan?
Ik zal Elize vragen of zij ook nog kan kijken naar de pagina. Zij heeft namelijk meer ervaring met privacy-gerelateerde zaken en kan mogelijk meer concrete voorbeelden noemen van consent issues waar onderzoekers vaker tegenaan lopen.
}
[Sander / Miriem]
Question: what is specific information that should be in your IC to accomodate for FAIR data and its further usage. IC information concerning secondary use of data / materials, potential data linkage to external registries (e.g. PALGA, IKNL)?
Step-wise how about something like:
Check your institute for an IC template
Miriem: Zou hier niet ook verwezen moeten worden naar de CCMO templates: Subject information, informed consent and informed consent procedure | Onderzoekers | Centrale Commissie Mensgebonden Onderzoek (ccmo.nl)
Check whether it allows for “whatever it is we need for making this data FAIR and its sharing”
I know there are factors which depend on the study, like e.g. linkage with PALGA, IKNL, etc.
Does this depend on FAIR Objectives? Does “I want to publish the study in the HRI Catalogue” require something different in an IC than “I want to use a patient’s data for federated querying?”
Miriem: Meestal moet er voor gezondheidsdata een data sharing agreement opgezet worden. Binnen het informed consent wordt de context van de dataverzameling beschreven en mag data binnen eenzelfde context gedeeld worden (indien er toestemming is gegeven voor data delen). Dit betekent dat er voor iedere data aanvraag gecontroleerd moet worden of de doelen voor het gebruik overeenkomen met de doelen die beschreven staan in het informed consent.
Het is nog wel een idee om hier iemand met kennis van wetgeving naar te laten kijken.
Sander: The first, I want to publish the study in the HRI Catalogue, doesn’t require anything special in the IC I think? Only when the data owner actually wants to share your data does the IC become relevant?
Meriem: De metadata over welke gegevens er zijn verzameld mogen vrij gedeeld worden (tenzij dit mogelijk valt onder geheimhouding vanwege mogelijke patenten oid). Maar ook hier zou ik iemand met meer kennis over het opzetten van (DSA) contracten naar laten kijken. Zij kunnen misschien meer toevoegen over de uitzonderingen.
Sander: Is “sharing” by sending someone the data and “sharing via federated querying” different? If federated querying is anonymous by default, since the data never leaves a center, does IC about sharing the data still matter?
Meriem: Ik weet niet of federated querying by default anoniem is. Volgens mij kan deze data nog steeds gepseudonimiseerd zijn. Daarom moet er nog steeds een goede infrastructuur worden opgezet waarbij de bescherming van persoonsgegevens gewaarborgd kan worden.
Federated querying is a method of querying and accessing distributed datasets without physically centralizing the data. In the healthcare context, federated querying allows researchers, clinicians, or data scientists to access and analyze health data across multiple systems (e.g., hospitals, research institutions) without transferring sensitive patient data to a central location.
When sharing or accessing health data via federated querying, compliance with the GDPR is crucial, particularly because health data is classified as special category data under Article 9 of the GDPR. Health data includes information such as medical history, diagnosis, treatment, and genetic data. Key GDPR principles relevant to federated querying include:Lawfulness, Fairness, and Transparency
Lawful Basis for Processing: You must have a lawful basis to access or share health data, such as explicit consent from the data subject, or processing for research purposes under Article 9(2)(j).
Transparency: Data subjects must be informed about how their data is used, even if it’s queried remotely. Transparent data-sharing policies and consent mechanisms are essential.
Data Minimization and Purpose Limitation
Minimization: The GDPR requires that only the data necessary for the specific purpose is accessed or processed. In federated querying, this means limiting access to the minimum amount of data required to answer the query.
Purpose Limitation: Health data accessed through federated queries must only be used for the specific purpose (e.g., research) for which it was originally collected, and not for secondary purposes unless additional consent is obtained or a legal basis exists.
Data Security and Confidentiality
Security of Processing: Federated querying must implement robust technical and organizational measures to secure health data. This includes encryption, anonymization, pseudonymization, and access controls to prevent unauthorized access.
Data Localization: Since data remains on local servers, federated systems reduce the risks associated with transferring health data, but the data controllers (entities holding the data) must ensure secure query execution and auditability.
Accountability and Governance
Data Controllers and Processors: Each institution participating in a federated querying system is likely to act as a data controller, responsible for ensuring GDPR compliance. Federated systems often require detailed Data Processing Agreements (DPAs) between the entities to govern how data is accessed and used.
Data Protection Impact Assessments (DPIAs): If federated querying involves high-risk processing of health data, organizations may need to conduct a DPIA to assess risks and ensure GDPR compliance.
Make sure the necessary lines are in the IC
Get the IC approved
[Meriem]
When sharing or linking health data with external registries (e.g., disease-specific databases, national health registries, or international research databases), the informed consent process must clearly define:
What data will be shared or linked: The type and nature of the health data (e.g., genetic data, medical history, treatment outcomes) that will be shared or linked with external registries.
Who the data will be shared with: This includes identifying the external registries, research institutions, or third parties that will have access to the data.
Purpose of data sharing/linking: The consent form should explicitly state the research purposes for which the data will be shared, such as epidemiological research, clinical studies, or public health monitoring.
Data security and anonymisation/pseudonymisation: Participants should be informed about how their data will be protected, whether the data will be anonymised or pseudonymised, and what security measures are in place during data sharing.
Step 0 - Determine whether your study is subject to the WMO
Determine whether your study is subject to the Medical Research Involving Human Subjects Act (WMO) or not. The Central Committee on Research Involving Human Subjects (CCMO) executes the WMO and the Embryo’s Act. Research that falls under the WMO or the Embryo’s Act must undergo a review by an accredited Medical Research Ethics Committees (MREC) or the CCMO. Research is not allowed to start without a positive decision of this committee.
Research is subject to the WMO if the following criteria are met:
It concerns medical scientific research and
Participants are subject to procedures or are required to follow rules of behaviour.
To learn more, contact your local experts, see the CCMO website or the ELSI Servicedesk (in Dutch).
Multi-center IC?
FAIRopoly
The development of this ICF benefited from previous experience with ICF submissions by 4 ERN Registries (ERKReg, EuRRECa, ENROL, VASCA) and from the utilization of “machine-readable” consent-related Ontologies (Data Use Ontology and Informed Consent Ontology). Several iterative expert reviews (including patient organizations and ERN representatives) were conducted to finalize the ICF.
Some potential sources:
ELSI Servicedesk? Unfortunately in Dutch.
Templates for ICs?
https://book.the-turing-way.org/project-design/sdpm/informed.html
[HANDS] - chapter privacy and autonomy
Consent
Consent aims at informing potential study subjects of all aspects of participation, including the procedures for data handling, data access and anonymity. An informed person can freely decide to participate or not. If someone does participate, he or she understands and accepts the risks and burdens involved in participation.
The Central Committee on Research Involving Human Subjects (CCMO) has produced guidelines for obtaining informed consent and has adapted the nationally mandatory proefpersonen-informatieformulier in light of the GDPR (for WMO research). In addition, the NFU working group ‘Privacy, ethiek & recht in gezondheidsonderzoek’ is currently developing a UMC format for broad consent, which may be applicable to certain non-WMO research. Advice on how to inform donors and patients about the use of their biomaterials and/or data in scientific research can be found at the ELSI servicedesk.
The ethical committee at your UMC can help you design your informed consent procedure. Regarding data management, the informed consent should include the person's wishes about:
the use and reuse of patient data for research in the current and future projects;
notification about the research results, including incidental research findings (special concern is required for results that cannot be interpreted now, but may be interpretable in the near future);
which data he/she can access, if applicable;
the possibility to withdraw certain aspects of informed consent and the consequences;
data use by commercial parties.
Consent should be documented along with the collected data, so subsequent users of the data are aware of the conditions agreed to by study subjects.
In general, it is very difficult to re-contact patients or study subjects to extend or change the consent. So, we advise you to obtain informed consent for storing clinical and personal data for the purpose of both healthcare and future scientific research, each with a separate specific informed consent (also see: care and research environment). In addition, patients should always be able to retract their consent.
Frequently Asked Questions
What does the EU General Data Protection Regulation state about consent?
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
And, regarding broad consent for scientific research: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”
When and with what procedure should patients give consent for the use of their data or biomaterial for scientific research?
This is described at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk.
What if it is impossible to ask for consent?
In some exceptional cases, you are legally allowed to perform scientific research without a consent. More information about this can be found at ‘Toestemmings- en bezwaarprocedures’ at the ELSI Servicedesk. Always minimise the data and specifically describe the arguments for not asking for consent and make sure that your institute or its Data Protection Officer has accepted your arguments, before you start your research.
Do I need informed consent to use anonymous data?
Informed consent is not mandatory if your data is truly anonymous. However, you should carefully consider whether your data indeed is anonymous: it may be possible to trace ‘anonymous’ data to an individual person by combining the data with other data sources. You should always be aware of this possibility when sharing your data with third parties. It is advisable to let an independent party (for instance a Data Access Committee or Board) objectively assess your proposed data sharing.
What does my institute need to do to inform patients?
Your institute needs to actively inform patients that they may be asked to participate in scientific research. Also, they should be informed that in some exceptional cases, it can legally be allowed to perform scientific research without a consent. Patients are offered the right to refuse to such use. Your institute needs to install a procedure to ensure that such refusals are followed through, i.e., if people have refused sharing their data for scientific research, these data should not be used in research.
What about genetic data?
The EU General Data Protection Regulation states that ‘Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.’
Most genetic studies will involve restricted access to individual level genotype and phenotype due to privacy concerns that are associated with this type of data.
The ELSI Servicedesk answers the question to what extent the data from whole genome sequencing are regarded as (directly) identifying. Also it advises on whether an informed consent form should state that genetic data is being processed.
Who can help me at my UMC?
Use the Toolbox to find support on informed consent at your UMC.
Further reading
For more information on incidental findings, please take a look at the BBMRI publication: Handreiking voor het constateren van, omgaan met en informeren over nevenbevindingen voor biobanken in BBMRI-NL.
...
Informed consent is the process by which a patient voluntarily agrees to a medical procedure, treatment, or participation in research after being fully informed about the relevant details. Informed consent is mandatory for all medical research involving human participants. Best known informed consent procedures are the opt-in and opt-out consent.
Opt-in. Patients actively agree to participate in a treatment or study after being informed about its details and risks.
Example: A patient signs a consent form before undergoing elective surgery, having discussed the procedure with their doctor.
Opt-out. Patients are automatically included in a program or research study unless they choose to decline.
Example: Patients are included in a healthcare system's data collection for research purposes unless they explicitly opt out.
Under GDPR, individuals must give clear and affirmative consent for their data to be used in research, i.e. opt-in consent.
Getting started
Starting a new study may require a multitude of documents. Here, we focus specifically on the FAIR components that can be included in the Subject Information Sheet (SIS, Dutch: PIF - proefpersoneninformatieformulier) and the Informed Consent Form (ICF).
Stuff from step 2
Subject Information Sheet
In the aforementioned model, chapter 10, “What will be done with your data and body material?“, contains several topics relevant for FAIR data. (or is there just one??):
<if applicable> Can we use your data and body material for other research?
Your collected data <if applicable> and your (remaining) body material may also be important for other medical research on [your condition and/or the further development of the product/treatment method]. For this purpose, your data <if applicable> and body material will be stored [in the hospital/research centre/...] for [...] years. Please indicate in the consent form whether you agree with this. Do you not want to give your consent? Then you can still take part in this study. You will get the same healthcare.
Here, it is of the utmost importance that the researcher clearly explains for which purposes collected data/materials may be reused. This may be broader than the original purpose of the study, but not too broad. For example, “cancer research” may be acceptable but “any research” is not. If stored data/material is used for a different purpose, participants must give permission again or usage is not permitted.
<If applicable> We send your data to countries outside the European Union
In this study, we will send your coded data <if applicable> and body material also to countries outside the European Union. The privacy rules of the European Union do not apply in those countries. Choice> But your privacy will be protected at a similar level . OR We ask your permission for this.
SdR: If I read correctly, you only give permission for this study. So my interpretation is that for other research you are never allowed to send the data outside the European Union. Is that correct?
SdR: maybe the full description is a bit overkill; they can look it up in the document.
SdR: Is this a FAIR point? It’s not a about reusing data, is it?
Add these section(s) (tbd) to ensure the SIS allows for FAIR usage of data and materials.
Informed Consent Form
The CCMO’s SIS contains an ICF as an Appendix, Of particular interest for FAIR data are the following items from the table with Yes/No questions:
<if applicable> I give consent to store my data to use for other research, as stated in the information sheet.
<if applicable> I give consent to have my (remaining) body material stored for use in other research, as stated in the information sheet. The body material is stored for this purpose for another [xx] years.
<if applicable> I give consent to ask me after this study if I want to participate in a follow-up study.
SdR: this is probably not relevant, since it will generate NEW data and is not about reusing the data already collected. Remove?
Add these questions to your ICF to ensure the FAIR usage of data and materials.
SdR:
If the current study does not require linkage to external registries, can you ask permission for this for future research, e.g. “In future research we may want to link your data to external registries, such as PALGA, CBS and IKNL”. Probably not?
If the current study does request permission for linkage to external registries, does permission automatically carry over to follow-up research? So, let’s say for the initial study I need some fields from the NKR and ask permission for data linkage. If participant asks permission for linkage and gives permission for other research, does this imply participant gives permission for linkage in other research? Meaning other research could fetch other fields from the NKR?
I don’t see any mention of sharing data/materials with commercial parties. Does that mean that you can share it or not? Probably not? How does that work for “other research”?
Some sentences I found in AOCR and COMPRAYA (for my mental reference)
Ik geef toestemming voor koppeling met andere Nederlandse registratiesystemen voor het opvragen van gegevens.
Ik geef wel/geen (doorhalen wat niet van toepassing is) toestemming voor onderzoek met mijn gegevens en materiaal door instellingen in het buitenland ook als het privacybeschermingsniveau minder is dan in Nederland.
Ik geef wel/geen (doorhalen wat niet van toepassing is) voor onderzoek met mijn gegevens en materiaal door commerciële partijen.
Ik geef wel/geen (doorhalen wat niet van toepassing is) toestemming om in de toekomst benaderd te worden voor eventueel vervolg onderzoek.
Ik geef toestemming om gegevens op te vragen bij bestaande Nederlandse registratiesystemen om meer inzicht te krijgen in het verloop van bepaalde aandoeningen. Deze registratiesystemen staan vermeld in deze informatiebrief
Susanne also pointed out the following:
If you intend to collect cause of death data via CBS (Statistics Netherlands) in the future, please include the following sentence with yes/no option in the consent form: 'If I die during the course of the study, I give consent to request my official cause of death data from the CBS (Statistics Netherlands)'.
Please note: The cause of death data must be intended for scientific research in the field of public health and the study must be carried out by a university, university hospital, planning bureau or other institution, as referred to in Art. 41 of the Statistics Netherlands Act.
SdR: is this relevant for FAIR data though? Are you even allowed to publish the data of death data from CBS, or does CBS require you to delete their data after x years / the study is finished?
Expertise requirements for this step
...