In order to review a study that is being conducted in an international setting and/or with international participants, the Board requires additional information about the study and its participants. Although we work to maintain a Board with a broad range of expertise, it is impossible to cover the diverse groups that are studied by our researchers. It is important to provide the Board with more details about the participants, appropriately identify risks to the participants, and describe how you will minimize those risks. Doing so will help the Board to accurately review your study and will demonstrate your preparedness for conducting your study. This section details specific information the Board needs to know as well as provides guidance for navigating conducting research in an international setting and/or with international participants.
The International Research Data Source question is designed to help researchers provide the Board with the information needed to assess an international study. For more information about completing this section of the protocol, see International Research Data Source. In addition, if your study will take place in the European Union or United Kingdom or uses data from citizens of those regions, your study will be subject to the GDPR. Please review the GDPR section below and access the GDPR Informed Consent Addendum to include with your consent materials.
An international setting involves any location outside of the legal jurisdiction of the United States. An international population could be a tight-knit community living within the borders of the U.S., such as the Hmong, or a broader group such as non-native Latinos. These groups generally have (though are not limited to) a distinct cultural identity that is different from mainstream American culture, speak a different language, and in some cases may not be U.S. citizens or could be undocumented.
If you are conducting a study in another country, it is important that you understand the legal implications of your study and how they might affect your participants. If you are collecting information about illegal behaviors, you need to understand what power the government has to take this information from you and use it against your participant. If this is an issue, participants need sufficient warning. In some cases, it may be necessary to waive documenting consent in order to protect a participant’s identity. Some participants may have a delicate political position because of refugee status or opposition to current political powers. It is important to understand how your involvement with the participants will affect their political standing, which can often impact personal well-being, employment status, etc. It is also important to investigate any laws that might affect how you should conduct your study. For example, in the U.S., there are specific laws governing how medical records and student records can be used by researchers. Similar laws may apply in other countries as well. As another example, the definition of a minor (i.e. child unable to legally consent) varies in different countries and even in the different U.S. states. You will be obligated to follow the local laws for the location in which you conduct your study and it is important that you are familiar with any laws that are pertinent to your study.
International participants may have different perspectives on legal documents, consent forms, etc, and may be wary of signing a consent form, whether of whether an actual risk exists. Documents like consent forms that appear to be legal in nature may be inappropriate in some cultural contexts. Although the Board has some restrictions on what it can allow, they will consider alternative consent scenarios that are culturally appropriate. For more information, see Oral Consent.
When writing your protocol, describe your procedures and then explain why they are culturally appropriate. For example, if you are using an oral consent process, explain why it is culturally appropriate for you to do so (i.e. the participants are offended when approached with a form, it is more appropriate to talk to them casually first before talking about the research process). This information will help the Board to understand the cultural environment in which you are working and will demonstrate to them that you are prepared to go forward.
In addition to understanding the local legal ramifications of your study and the cultural context, you will need to investigate the local IRB requirements. The IRB-SBS expects international participants to be treated the same as participants from the US and we review a protocol as such. However, our review does not supercede the authority of an IRB that governs an international location; depending on the circumstances of your study, you may be subject to both the UVA IRB-SBS review and a local IRB review as well. For more resources on international human subjects regulations, see International from OHRP's website (check out the Listings of Social-Behavioral Research Standards specifically).
The Board expects you to provide the participants with a consent process that is in their native language (or the language in which they usually read and converse). This includes not only providing a consent document written in the participant’s language but also providing a translator that the participant can talk to if he or she has questions if you are not able to speak the language sufficiently. The translator will be considered part of the research team and is obligated to follow the protocol for protecting confidentiality. In some situations, the Board may require a separate consent process for the translator.
In order for a participant to be informed, it is necessary that the consent process be conducted in a language the participant can understand. If you anticipate recruiting non-English speaking participants, the Board asks that you provide a version of the consent form in the language that is appropriate for the participants, as well as arrange for an individual who can talk with the participants (if you do not speak the language). The interpreter must understand confidentiality issues and should be a trusted member of the research team.
As stated in the "Legal Preparedness" section, consent forms may not be appropriate for some international settings and it may be more appropriate to use an oral consent procedure. For more information, see Oral Consent.
In the consent templates, we ask that you provide the participant with your contact information as well as the IRB-SBS contact information. Depending on your location and population, it may not be feasible or realistic for your participants to contact our IRB if they have questions. Thus it is important for you to provide a local contact who can be available to answer questions and provide support if a problem should arise. For undergraduate and graduate students, this person can be your local advisor (please note that you are required to have a local advisor when you are conducting a study abroad. Please see Student Researchers for more information). Other options may include (but are not limited to) a qualified individual in a local research facility, IRB, or hospital.
GDPR applies to select data when collected from individuals located in the European Economic Area (EEA) and/or the United Kingdom (UK). GDPR regulates the collection, use, disclosure or other processing of personal data. If you are collecting personal data in the EEA or UK, or if your participants reside in those areas, you are subject to the GDPR. If your participants are EEA or UK subjects but are outside of the EEA or UK when the data collection occurs, the data collected is not subject to the GDPR.
While many of the US federal regulations mirror the requirements in the GDPR, the GDPR requires researchers to provide additional consent form content and conduct specific processes related to data collection.
While this section and the GDPR Informed Consent Addendum provides some guidance on what is required under the GDPR, please note that individual countries may have varied interpretations, etc. It is important that you familiarize yourself with the laws and regulations of the country(ies) in which you will conduct research and seek counsel if needed. Check out this OHRP site which provides a compilation of information on the GDPR and how it is interpreted in various countries.
Regarding the underlying philosophy about consent, the US OHRP regulations regarding consent and the GDPR’s consent requirements agree that participants need to be fully informed in a non-coercive fashion.
“When asking for consent, a controller has the duty to assess whether it will meet all the requirements to obtain valid consent. If obtained in full compliance with the GDPR, consent is a tool that gives data subjects control over whether or not personal data concerning them will be processed. If not, the data subject’s control becomes illusory and consent will be an invalid basis for processing, rendering the processing activity unlawful.”
The GDPR expands on the concepts of informed consent by increasing the expectation for the information provided to participants.
“Article 4(11) of the GDPR defines consent as: “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.””
This concept mirrors our evaluation that consent must be provided in a manner and environment free from coercion, either real or perceived.
Like the US regulations require, consent must provide participants with specific and clear information how their data will be used. The GDPR requires the following regarding consent specificity:
- Purpose specification as a safeguard against function creep: expanding how the data will be used beyond what was described in the consent form after consent is collected.
- Granularity in consent requests: if a researcher collects data for various purposes, the participant should be able to opt-in for each purpose. For example, if the researcher is using an interview for a study and will also provide the interview to a library, the participant should opt in to both uses of the data.
- Clear separation of information related to obtaining consent for data processing activities from information about other matters: related to the example above, the consent should provide specific information for using the interview in the study as well as using the interview in the library.
Similar to the US regulations, participants need to be provided with consent information prior to agreeing to the study, assuring that the participant understands what they are agreeing to as well as how they can withdraw from the study.
The following are the minimum requirements for the information provided to participants in an informed consent process:
- the controller’s identity
- the purpose of each of the processing operations for which consent is sought,
- what (type of) data will be collected and used,
- the existence of the right to withdraw consent
- information about the use of the data for automated decision-making in accordance with Article 22 (2)(c)34 where relevant
- on the possible risks of data transfers due to absence
All of the above items are part of our consent templates and are further outlined in the GDPR Informed Consent Addendum. As required by our consent process, the information provided must be clear and easy to understand by the participants and is appropriate for the participants (i.e. if the participants are minors, the text is written to the appropriate reading levels). In addition, it is important that the consent be separate and distinct from the data collection. For example, the consent form is provided as a separate paper from the rest of the paper materials provided to participants, or in the case of an online survey, the consent is a distinct page or site and doesn’t look like part of the data collection activity.
Unambiguous indication of subject’s wishes
It must be clear that consent is provided in an intentional act through an active motion or declaration. Consent can be collected through written or oral statement that can be documented electronically. Opt-out options or pre-ticked boxes are not legal: “Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice.”
Documentation of Consent:
The GDPR allows for flexibility in how consent is documented, allowing for electronic consent, oral consent, written consent, etc.
“It is up to the controller to prove that valid consent was obtained from the data subject. The GDPR does not prescribe exactly how this must be done. However, the controller must be able to prove that a data subject in a given case has consented. As long as a data processing activity in question lasts, the obligation to demonstrate consent exists. After the processing activity ends, proof of consent should be kept no longer then strictly necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims, in accordance with Article 17(3)(b) and (e).”
The GDPR pays particular attention to consent withdrawal and expects the process to be equal to obtaining consent in regards to ease. For example, if obtaining consent is a simple “I accept” button but requesting a withdrawal involves a phone call to an international number, the withdrawal process is more complicated and does not equal the obtaining consent process. Rather, participants need to be provided with a simple “I withdraw” option as well.
Regarding scientific research, there is some flexibility as the GDPR recognizes that researchers don’t always know the precise way in which the data will be used, but the expectation for providing specific information is still there.
“Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.” First, it should be noted that Recital 33 does not disapply the obligations with regard to the requirement of specific consent. This means that, in principle, scientific research projects can only include personal data on the basis of consent if they have a well-described purpose. For the cases where purposes for data processing within a scientific research project cannot be specified at the outset, Recital 33 allows as an exception that the purpose may be described at a more general level.”
- International Research Data Source
- Understanding Risks in Research Studies
- Responsibilities of Researchers
- Oral Consent
- Student Researchers
- Consent Templates
- International (OHRP)
- Listings of Social-Behavioral Research Standards (OHRP)
- Compilation of European GDPR Guidances (OHRP)
Article 29 Working Party Guidelines on consent under Regulation 2016/679 Adopted on 28 November 2017 As last Revised and Adopted on 10 April 2018