GDPR Guidance > What you need to do >
Whatever you may have assumed your legal basis was previously, it is unlikely that you set this out to participants in the Participant Information Sheet for your study. Therefore, in most cases, you will not need to correct existing information.
However, under GDPR, in most cases you will need to provide transparency information about your legal basis and other details of processing personal data from 25 May 2018. The table in our guidance sets out the required information that you will need to provide if you collect any new personal data, or if you process any personal data already collected. The table separates out what transparency information you need to provide depending on whether you are collecting personal data directly or indirectly from participants.
The rest of this
section sets out the options for providing this information, how you can
provide it, and the factors that determine what changes you need to make to
your study.
Direct and indirect collection of personal data
For most studies there will need to be transparency information in relation to both the site and the sponsor.
Where possible the sponsor should set out the transparency information relating to both the research activities at sites that involve processing of personal data as well as any processing by the sponsor, including the act of anonymising. Remember, the requirements relate to personal data and not to data that is no longer identifiable or where the participant cannot be identified in combination with other data held by or available to the sponsor or any processor acting on behalf of the sponsor. However, to meet ethical expectations, you should still provide clarity to participants about what is happening to their data even when it is no longer personal data.
As noted elsewhere in this guidance, the sponsor is the controller and obtains personal data directly from data subjects for research when the information is intended to be used for research purposes at the time it is collected. This includes personal data obtained on behalf of the sponsor by clinical staff at a site or a research laboratory, as well as that provided by the participant to the sponsor. When personal data is obtained directly for research, the transparency information set out in the first column of the table should be available and accessible to the data subjects at the time the personal data is collected.
The sponsor is the controller and obtains personal data indirectly when the personal data was collected by a different organisation for a purpose other than research at the time it was provided by the data subject, or when the personal data was provided to a different sponsor for research. When personal data is obtained indirectly for research, the transparency information set out in the second column of the table should be available and accessible to the data subjects within one month of the sponsor obtaining it. The provision of the transparency information may be made by the source of the data on behalf of the sponsor. However, exemptions to this provision of transparency information may apply in specific cases where the personal data is obtained indirectly, when one of the following applies:
- Providing
information to affected people is impossible or requires disproportionate
effort, or
- Providing
information will seriously impair or render impossible the objective for which
you are processing that personal data (i.e. researchers will not be able to
deliver their research objectives)
Where such an exemption is relied upon the receiving sponsor should ensure:
- Technical
and organisational safeguards are in place that respect the principle of data
minimisation, like pseudonymisation, where possible, and
- The reason for relying on an exemption is documented.
Providing transparency information for new and existing studies
The GDPR requirements for transparency relate to the point of collection of personal data (directly or indirectly) and on an ongoing basis, eg at the point of change of purpose (eg changing use from clinical care to research) or if data subjects need to be informed of further details because the law is changing and you are still processing their personal data. The transparency requirements will differ depending on whether you collect personal data from participants or not, and whether you can contact participants or not. In existing studies where there is contact with participants, and for new studies that seek consent this is straightforward. For new studies where you will not seek consent, or existing studies where participants cannot be contacted a more creative approach will be needed. This will be specific to circumstances and depend on how likely participants are to notice the information.
For existing studies, what you need to do will also depend on whether the site and/or sponsor will be collecting any more personal data (directly or indirectly), processing personal data, or whether all data has already been collected and the processing (eg analysis or storage) no longer involves personal data. If personal data have already been collected and processing of personal data is complete eg if analysis of results involves data that is no longer identifiable, then there is no need to provide new transparency information under the GDPR.
GDPR sets out that information provided to data subjects should be clear, intelligible and accessible. You can do this by providing layered information that allows people to obtain information at the level of detail they are interested in. For example, simple basic information provided directly to participants can be supplemented by more detailed information on a study website. If you have participants at different stages of your study (eg some being recruited and some in long-term follow-up) you should tailor the provision of information appropriately. You should consider the route for providing transparency information, for example, would information be more accessible and available if provided and/or published by the site(s) on behalf of the sponsor as well as by the sponsor.
Importantly, if you do need to provide transparency information, this does not mean that you need to amend existing Participant Information Sheets, or submit amendments for approval. You can provide transparency information in a separate document from the Participant Information Sheet and via websites.
Non-substantial, non-notifiable amendments
We have published recommended wording for these documents which will allow your amendment to be classed as a non-substantial, non-notifiable amendment that does not need to be submitted for approvals, and can simply be implemented. It is important that any amendments relating to GDPR are not bundled in with other changes as part of a single amendment submission – GDPR amendments should be dealt with separately.
Non-substantial, non-notifiable amendments should be provided directly by the sponsor to the site research team. They should not be submitted for categorisation or approval, and should not be provided separately to R&D offices. They should be implemented on the date specified by the sponsor, with no opportunity for objection by the site. If any subsequent amendments to the study are submitted for approval, the previous non-substantial, non-notifiable amendments should be included to avoid confusion about amendment numbering or document versions.
A template email is available from the HRA for sponsors to use to provide the amended documents direct to participating research teams.
To work out what you need to do, identify the situation below relevant to your study. If you have an existing study, more than one scenario below may apply for different participants. The scenarios below only apply to collection and/or processing of personal data.
Where you do need to submit an amendment, you need to separate out amendments relating to GDPR from any other amendments to avoid confusion about non-notifiable and notifiable amendments.
All amendments whether notifiable or not, should include the information to be provided to participants and/or sites, and include links to any information published elsewhere.
Where personal data is obtained indirectly from another data controller you should consider whether you can provide information, and document your justification for relying on an exemption.
The scenarios below apply to cases where personal data is provided directly by data subjects. Where personal data is obtained directly from another controller you should consider whether you can provide information, and document your justification for relying on an exemption:
A. New study not submitted for approvals before 25 May 2018
Incorporate the recommended wording into your Participant Information Sheet(s) before submitting for approvals.
B. Study approved and recruiting new participants after 25 May 2018
Provide transparency information to new participants using the recommended wording, either as a separate document or by updating the Participant Information Sheet(s). The additional document or revised Participant Information Sheet(s) should be versioned, and you should record that the amendment to your study document is non-substantial and non-notifiable.
If you already have some participants, it may be easier to provide information in a separate document alongside the Participant Information Sheet when you recruit new participants. If you haven’t started recruitment, it may be easier for sites if you revise the Participant Information Sheet(s).
C. Study approved and participants are still in the study after 25 May 2018
As participants are still in the study, if personal data is still being collected directly by the sponsor, you should provide transparency information to these participants when data is next collected directly from them or sooner if you interact with them directly. Use the recommended wording in a separate document if no other aspects of your Participant Information Sheet need to change. You do not need to re-consent existing participants for the purposes of the common law duty of confidentiality or to fulfil other legislation (eg clinical trials) when you provide them with the new transparency information.
If any of the following situations apply you will need to revise your previous Participant Information Sheet(s) as a non-substantial amendment (and submit in the usual way). As the changes listed below could affect the perception of a participant about the study, you should consider whether participants may want to review their participation in the study.
- · If you previously told participants that your legal basis for processing personal data was consent (ie specifically used the phrase ‘legal basis’, ‘lawful basis’ or equivalent) and you are now changing your legal basis to ‘performance of a task carried out in the public interest’ or ‘legitimate interests’ and/or
- you are removing any safeguards that you previously told participants and/or
- you are changing any subject rights that you previously told participants and/or
- you are changing the purpose (that is, the general purpose eg research) for which personal data are being processed from what you previously told participants
If you can no longer contact participants, but personal data is still being collected (eg the sponsor is obtaining existing data from an NHS organisation) or being processed, you should consider how to provide the transparency information through other means. For example, the research sponsor’s website or a study-specific website could provide information.
You should consider the routes through which transparency information can be provided. For example the source of the personal data (eg NHS site or research database) may have ongoing contact with the data subjects. Where research exemptions relating to provision of transparency information (see above) are relied upon, the reasons should be documented.
If no further personal data will be collected or processed after 25 May 2018, transparency information does not need to be provided to participants, even if you are still processing data that is no longer personal data, eg for analysis.
D. Study approved and participants will have completed the study by 25 May 2018
Even if participants have completed the study, you may still be processing personal data if you are storing information that is identifiable or could be identified. You should consider how to provide the transparency information. You should not access the names and contact details (eg by breaking the code) solely to provide transparency information if you have no other reason to access this information. Instead, you could provide information via the research sponsor’s website or a study-specific website if this is a normal route of communication in your study. Alternatively, individuals who hold the list of codes (eg NHS clinician) may be able to provide information or publish information on the site’s website. If this is unlikely to be accessible to participants, there are possible exemptions and you should refer to the HRA’s briefing notes and seek advice from your organisation.
Where the sponsor is the site, even if the individuals analysing the study or storing research data are different from the individuals with access to the code, the organisation as a whole will have identifiable information and so will still be processing data. In some cases, these studies could have been completed some time ago. It may not be practical to provide transparency information directly to participants, and you may be able to rely on exemptions. You should refer to the HRA’s briefing notes and seek advice from your organisation.