Role of consent and the UK GDPR
Role of consent and the UK GDPR
Under the UK GDPR, consent is one of six lawful bases for processing personal data. While “public task” is commonly used as a lawful basis in the UK, consent may also be utilised. The legal basis is usually defined by the host organisation; therefore, researchers should consult with their institution to determine the appropriate lawful basis for their specific project.
Consent can also be used for processing special category data. However, in practice, institutions such as universities often rely on “research in the public interest” as the lawful basis for processing such data, provided appropriate safeguards are in place. These safeguards may include measures such as anonymisation, encryption, or restricted access to sensitive data to ensure compliance with legal and ethical standards. By aligning with institutional guidance and legal requirements, researchers can ensure their data processing practices are both compliant and ethically sound.
Therefore, for researchers, consent serves two distinct purposes:
- As an ethical obligation when involving participants in research informing the protocols for participation and uses of collected data.
- As a lawful basis under data protection laws.
Researchers must ensure they address both aspects appropriately and avoid conflating ethical research consent with consent for data processing under the UK GDPR. It is essential to distinguish between these two applications of consent.