Does privacy by default mean researchers should reconsider research ethics practice in relation to recording informed consent

Abstract

It is normal practice for researchers collecting data from ‘human subjects’ to record that their participants have provided ‘informed consent’. This often means recording personal data such as a name, address and signature when the underpinning research question – or in legal terms ‘the specific purpose for processing data’ does not actually require this. The provisions of GDPR in relation to ‘privacy by default’ might provide a rationale to revisit normal practice and ethical guidelines to give greater emphasis to anonymisation or pseudonymisation at the point of data collection. It is recommended that research organisations and researchers revisit normal practices and guidelines to consider where anonymised data collection might be utilised more fully.