3. Information and consent

3.a Consent

Personal and health information in research shall be collected and processed for specific, explicitly stated, and justified purposes and shall not be further processed in a manner incompatible with these. The treatment shall be based on the consent [1] of the research participants whenever possible [2].

Student and research project

• Project manager/supervisor/student prepares information letter with accompanying consent form according to NSD or REK's templates:
  • Consent must be informed, voluntary and explicitly expressed. The consent meets the requirements when the conditions for consent are met, and it is based on specific information about the specific research project.
  • It is essential that the wording of the information is adapted to the recipient. This can mean avoiding the widespread use of academic terms and academic language or translating into languages that the recipient understands.
  • The main rule for persons without consent competence (minors, dementia, mental retardation) is that the next of kin are informed and asked to consent.
  • Consent must be documented in writing or recorded.

The project manager/supervisor/student may not use information about persons who do not agree to participate in the project.

3.b Exemption from consent

The processing of personal and health information in research shall, generally, be based on documented consent from the research participants whenever possible. In some types of projects, processing of the data material may take place on a different legal basis than consent as long as the processing meets the conditions in the Privacy Ordinance [3]. Exceptions from consent may be relevant for projects that use information from national registers (SSB), from medical records (in retrospective studies), in observational studies or from sources on the Internet. It is expected that the sample will be informed about the treatment if this is practically possible.

Requirements for written information and documentable consent during fieldwork can be difficult to fulfil. Alternatives to consent can be used in such projects. It is a prerequisite that corresponding oral information and consent is given when the researcher/student contacts the committee.

Exceptions from the consent conditions are based on discretion and depend on the method and type of sample. The person responsible for research ethics and privacy at HVL can supervise such projects.

Confidential information

When the information is subject to confidentiality, the researcher must obtain a dispensation from the confidentiality from, for example, REK (information in health registers, medical records) or Statistics Norway (public registers). In other cases, one must apply to the authority that "owns" the information you want access to. For example, it will be relevant to apply to Bufdir by accessing confidential information in the Child Welfare Service when it is not possible to obtain consent, or to the Prison and Probation Service if you will have access to information about inmates in Norwegian prisons.

When observing at a health institution without consent, a dispensation from professional secrecy requirements must be obtained from REK.

Health information

For the use of health information in health research projects, you must apply for a dispensation from professional secrecy requirements. REK also has the authority to assess exemptions from the professional secrecy requirements for other types of research [4]. This may be relevant for projects that are to research human biological material or health information that has already been obtained.

REK will assess whether it is difficult to obtain consent in the project, whether the research is of significant interest to society and whether consideration for the participants' welfare and integrity is considered before granting a dispensation.

When observing at a health institution without consent, a dispensation from professional secrecy requirements must be obtained from REK.

3.c Access, correction and deletion, revocation of consent and reservation

Participation in research projects is, generally, based on volunteering. Anyone who has been informed about the processing of their personal data may demand access, correction of incorrectly registered information, deletion of information, revocation of consent, and withdrawal from further participation in the study if they can be identified in the data material.

Research participants who wish to access, correct, or delete their personal data, wish to withdraw their consent or reserve their personal data from further processing may request this without stating the reason. The project manager must process inquiries without undue delay and no later than 30 days.

When a research participant requests access, the project manager considers whether this should be granted, limited, or rejected. The decision must be substantiated. In case of doubt, the person responsible for processing is consulted by a privacy representative/privacy adviser or research adviser at HVL.

• The research participant has the right to have incorrect and incomplete personal information about themselves corrected.
• The research participant has the right to have their personal information deleted if the information is no longer necessary for the research or the consent is revoked. Other matters where this may apply are described in Article 17 of the Privacy Ordinance.
• If a research participant withdraws his or her consent or reserves him- or herself from participation, all personal information about the participant must be deleted and the research data further processed in anonymised form.
• The research participant can appeal the decisions of the data controller to the Norwegian Data Protection Authority.

_{[1] GDPR  art. 6 nr. 1 a), jf. art. 9 nr. 2 a.}

_{[2] When consent is not possible, other legal grounds for research purposes may be in the public interest, Art. 6 No. 1 e) or for special categories of personal data "archival purposes in the public interest, for purposes related to scientific or historical research or for statistical purposes (Art. 9 no. 2 letter j). This applies as long as society's interest in the treatment taking place clearly exceeds the disadvantages for the individual.}

_{[3] For personal data, waiver of the consent rule may be granted in accordance with the regulations. Articles 6 and 9 of the GDPR.}

_{[4] Regulations relating to delegation of authority to REK pursuant to Section 29, first subsection of the Health Personnel Act (in Norwegian only) and Section 13 d, first subsection of the Public Administration Act (in Norwegian only).}