Explicit user consent is informed, voluntary permission for an organization to collect, access, share, or use personal data for a specified purpose. It makes the purpose, risks, benefits, protections, and withdrawal process clear before participation. section 8.1.3 section 8.2.1
A practical consent protocol should address:
- The data and purpose: explain what information will be collected and how it will support the proposed analysis. section 8.1.3 section 8.2.1
- Potential harms and benefits: describe privacy, disclosure, or other risks alongside possible participant and societal benefits. section 8.1.3
- Protective practices: limit access, retain data only as long as necessary, and collect only what the stated purpose requires. section 8.2.1
- Participant control: provide information about data use and a workable process for denying consent, deleting data, or withdrawing from the analysis. section 8.1.3 section 8.2.1
Consent operates within a changing legal and organizational context. Analytics teams may need to coordinate with IT, security, and legal colleagues, while smaller organizations may carry more responsibility for enabling individual rights. section 8.2 section 8.2.1
Wearable-health study
A wearable company studying predictors of hypertension and heart disease should obtain written informed consent before collecting detailed diagnosis information. The protocol should explain risks and benefits, protect sensitive health data, and honor a participant’s request to withdraw consent. section 8.1.3
Figure 8.3 Many types of sensitive information are governed by sector-specific laws, both in the US, as in the examples shown here, and around the world.
Use the figure to survey how sector-specific laws govern different categories of sensitive information. section 8.2.1
