Consent to Participate Is Not Permission to Use Data

Part of Consent and Vulnerable Populations: Data, Samples and Secondary Use.

About 6 minutes. Free, in your language, no account needed.

Why this matters

Two questions get conflated constantly, and they are genuinely different.

Will you take part in this research? An agreement to have things done to you: to receive an intervention, attend visits, undergo procedures.

May we use information about you? An agreement about data that may already exist, may be collected routinely, and may be used long after any participation ends.

A person may reasonably answer yes to one and no to the other. A consent process that treats them as a single question does not let them.

Why the distinction is becoming central

ICH E6(R3) Annex 2 addresses additional considerations including the use of real world data, and includes consent and permission considerations for it. That the guideline addresses this separately is a signal about where the field is going.

Research increasingly uses data that was not collected for research: electronic health records, claims data, registries, and routinely collected clinical information. In this research nothing is done to anyone. Nobody attends a visit or receives an intervention, and the traditional consent model, built around agreeing to procedures, does not fit.

Yet the data is about people, and people have interests in it, so some permission is required. What that permission looks like, and when it may be dispensed with, is the live question.

The routes

Specific consent. The person agrees to this use of their data for this study. The strongest and frequently impossible: a study using ten years of records cannot obtain specific consent from everyone in them, and those it could reach are systematically different from those it could not.

Broad consent. The person agrees, at some earlier point, that their data or samples may be used for future research of a described kind. This is workable and its limits matter, covered in the next lesson.

A waiver or approval without consent. Many frameworks permit an ethics committee to approve research using existing data without consent, subject to conditions: that obtaining consent is impracticable, that the research could not be done otherwise, that the risk is minimal, and that the use does not conflict with anything participants were told.

A separate legal basis. Data protection law provides bases for processing that are independent of consent, including public interest and scientific research provisions. This is a distinct body of law with its own rules, and satisfying a medicines framework says nothing about satisfying it.

The failure mode

A participant consents to a trial. The consent form mentions that their data may be used for research.

Years later, their data is used in an unrelated study.

Is that covered? It depends entirely on what the form said, and most forms say something general enough to be read either way. The person who drafted it was not thinking about the later study, and the person proposing the later use reads the general language as permission.

The reading is convenient and not obviously wrong, and the participant never had a chance to consider the actual question, because it did not exist when they were asked.

What a good consent does

Separates the questions. Participation here; data use here; samples here; future research here. Each with its own agreement.

Makes the data and sample questions genuinely optional where they are not essential to the trial. A participant should be able to join the trial and decline optional future use, and a form that bundles them has not offered a choice.

Is specific about future use. What kinds of research, by whom, for how long, and whether the data or samples may be shared outside the original organization or country.

Explains withdrawal accurately. What can be withdrawn, what cannot, and why. Data already used in a completed analysis usually cannot be removed from it, and saying so honestly is better than implying a complete right of deletion that does not exist.

In practice

A trial's consent form is restructured into four separate agreements, each with its own signature or initial.

Participation in the trial. Use of trial data for the trial's analysis and regulatory submission. Storage of samples for future research with a described scope. Recontact for future studies.

The first two are required for participation; the second two are genuinely optional and the form says so.

Over the trial, 94 percent consent to sample storage and 71 percent to recontact. The 29 percent who decline recontact had a preference that a bundled form would have recorded as agreement.

The site initially objects that four agreements are more work. The counter is that the alternative is one agreement that does not represent what a third of participants actually wanted.

What this looks like when it goes wrong

A trial's consent includes a paragraph stating that data may be used for future medical research.

Eight years later, the sponsor contributes the anonymized dataset to a data-sharing platform that provides access to qualified researchers worldwide.

The paragraph does not mention sharing with third parties, does not mention other countries, and does not mention any platform.

The sponsor's position is that the paragraph covers it, and a reasonable person could read it either way, which is the problem. Participants agreed to something whose scope they could not have known, because the arrangement did not exist and the language was general enough to stretch.

No participant has complained, which is not evidence of consent. It is evidence that nobody told them.

Key takeaways