Consent

Here you can find information about consent - including requirements for a valid and documented consent and consent and information duty templates. 


There are different kinds of consent

As a researcher you will often come across situations in which you are under a legal obligation to obtain consent from coming participants (data subjects) in your research project, or in which it is simply good practice to do so.  

It is important that you are aware that these consent requirements do not necessarily entail that you should employ such consent as the legal basis for processing the subjects’ data. In fact, quite often it will be more appropriate to employ a legal basis other than consent as the legal basis for processing personal data for your research.  

In the words of the Danish Data Protection Agency:

“Especially in connection with research, it is important not to confuse consent to process personal data with a consent requirement that follows from other relevant legislation. While you might be obligated to obtain ‘consent’ pursuant to other legislation, this does not necessarily mean that consent has been granted as defined by data protection legislation. The requirement to obtain ‘consent’ of this kind will often constitute an important procedural rule in other legislation, but this does not necessarily mean that such consent can serve as the legal basis for the processing of personal data.” 

Source: The Danish Data Protection Agency report "Bidrag fra Datatilsynet: Erfaringsindsamling i forbindelse med Justitsministeriets nationale evaluering af databeskyttelsesreglerne", April 2021

Find out more about the different legal bases basis for processing personal data in research below. You’ll also find more information about the special conditions that determine whether consent can serve as a legal basis for the processing of personal data.

If you choose to process personal data on the legal basis of consent, you are responsible for ensuring that valid and documented consent is obtained pursuant to data protection law.  

AU has two templates for obtaining valid consent pursuant to data protection law. These consist of a consent form and an information form. By filling out both forms, you will have met your obligation to obtain valid consent pursuant to data protection law as well as your information duty.  

Before processing personal data, you must determine whether Aarhus University is an independent data controller or a joint controller together with an external party. 

You can find a guide to fill out the consent form and information duty in the template.

Frameworks for valid consent to data processing

SCOPE

Personal data may be processed for the specific purposes to which the data subjects have given their consent.  



DOCUMENTATION REQUIREMENTS

Consent must be documented. Therefore, you should obtain written consent. You can use the AU consent form.  

You also have to document that the data subjects have received the information required for the consent to be valid as well as the information required to meet the information duty. You can use the AU form to meet the information duty. 


PARTICIPANTS' (DATA SUBJECTS') RIGHTS

As a general rule, data subjects can exercise all of their rights under the General Data Protection Regulation. If data subjects want to exercise their rights, you have to make an individual assessment based on the specific circumstances. 

Data subjects are also entitled to withdraw their consent. This means that you must stop processing their personal data. 


DISCLOSURE OF DATA WITHIN THE EU/EEA (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You may only disclose personal data if you have the data subjects' consent to do so.  


DISCLOSURE OF DATA OUTSIDE THE EU/EEA (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You may only disclose personal data to a recipient outside the EU/EEA if you have the data subjects' consent to do so. Note that there are special requirements for the information to be provided to the data subjects about the transfer.   


DISCLOSURE OF BIOLOGICAL MATERIAL (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You may only disclose personal data in the form of biological material for other research if you have received the Danish Data Protection Agency's approval to do so. 


PUBLICING PERSONAL DATA

You may only disclose personal data with a view to publishing if you have the data subjects' consent to do so.   


HOW TO REFER TO YOUR LEGAL BASIS

  • Processing of ordinary personal data: Article 6(1)(a) of the General Data Protection Regulation. 
  • Processing of sensitive personal data: Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation. 

Conditions for valid consent to data processing

Here you can find the conditions for a valid consent to data processing. A valid consent must be given freely, be specific, be informed, be an unambiguous indication of the data subject's wishes, be withdrawable and communicated in clear and easy-to-understand language in an easily accessible form. 


Given frely

Given freely means that the data subjects (the persons whose personal data will be processed) may not be and cannot be affected negatively if they choose to say no to having their data processed.

You should therefore consider:

  • the circumstances under which consent is given
  • whether the persons whose consent you want belong to a particularly vulnerable group of people
  • whether there is a clear imbalance in the relationship between AU and the persons who are to give their consent

For consent to be given freely, the persons who give their consent must have the option of saying 'yes ' or 'no' to different processing purposes.


Example:

A data subject may want to give consent to the use of their personal data in your research project, but not want you to use the data for teaching purposes or for publication.


Specific

For a consent to be specific it must be specific about the processing purpose(s) for which consent is given.

You must therefore specify for which purposes you intend to process the personal data of your data subjects. As a minimum, the purpose should be sufficiently specific to make it clear to the data subjects that your research (and thus processing of their personal data) will be in a specifically recognised scientific field.


Informed

Informed means that the data subjects should have information about who will process their personal data and how the data will be processed.

The data subject's consent must be given on an informed basis.

See what information the data subject should be provided with in the consent form and the associated appendices for meeting the information duty.


Unambiguous indication of the data subject’s wishes

Unambiguous indication of the data subject’s wishes means that data subjects must actively consent to the processing of their personal data. In other words, no data subject can commit to anything by being passive.

The research coordinator must be able to document that consent has been given.

This can be done in several ways. For example, you can use the AU consent form. If you use the AU consent form, the data subjects have to tick off the processing purposes that they give consent to and then sign the form.

If you collect consents digitally, you can use a form on the AU website with checkboxes that then document the data subjects' choices in TYPO3. See GDPR guidelines for web editors.  You can also use a two-factor authentication system. In this case, you can, for example, obtain consent via a checkbox solution on the website and then send a confirmation email to the participant with a link they can use to confirm their consent. 


Withdrawable

For a consent to be withdrawable, the consent must be just as easy to withdraw as it was to give.

Remember to include information in the consent form on how data subjects can withdraw their consent. For example, this could be by calling, sending an email or logging into their profile and unchecking the relevant boxes.

If consent is withdrawn, processing of personal data must stop. Any processing performed up to the point of withdrawal is lawful.


Communicated in clear and easy-to-understand language in an easily accessible form

The wording of a consent must take account of the data subjects who are to give the consent. The language of the consent must therefore be plain (in layman's terms).

The design of the consent is subject to special requirements if the data subjects are children. For example, you may have to use a different style of language for the consent than if the participants were adults. However, this will always depend on a specific assessment. To ensure that your style is easy to understand, you should:

  • be aware of the length of the text
  • avoid text in small print
  • make sure the data subjects have all the information in a single document if the document is a physical document, or, if you obtain the consent digitally, provide a link to a privacy policy that clearly communicates the information that the data subjects need
  • consider designing the consent in headings

See the AU consent form. Note that you may have to make adjustments to the form, depending on the data subjects you want for your research project. 


With regard to children and consent

The data protection rules include special protection for data concerning children, particularly with regard to information society services, e.g. social networks. Consent must be obtained from the holders of parental authority over the child, and this consent must be documented. Furthermore, all information addressed at children must be written in a clear and straightforward manner that children can understand.