Updated 25 October 2016

Ethics and Patient Confidentiality

Obtaining the necessary patient consents is an essential part of joining the ECFS Patient Registry, as required by the EU Directive 95/46/EC. As each participating country will have its own legal interpretation of this Directive, it is important to check the suggested sample consent forms with your local Data Protection Officers.

Furthermore, patients should be notified accurately of all plans for collecting and processing their data, and this is determined by the design of the ECFS Patient Registry. The explanatory information sheet provides more detailed information. The various documents needed for application to your local data protection authorities can be downloaded from this page. If you have any questions, please contact Jacqui van Rens (jacqueline.vanrens@uzleuven.be), before you get started.

Please follow the relevant course below depending on whether your country already has patient consents or not.

If you have existing consents which satisfy your local laws:

  • If you already have existing consents, please check with your local Data Protection Officer to make sure these forms meet the requirements of the new European Registry or whether you will need new patient consents. e.g. using the
    "Patient Information Sheet" Template and
    "Patient Consent Form" Template.
  • If your local Data Protection Officer approves your existing consents, please informJacqui van Rens (jacqueline.vanrens@uzleuven.be) along with a copy of the approval from your data protection authorities. This approval should be in English. if not we will need both the original document and a translation. Furthermore, we will need a signed statement from either your country representative if you have a national registry, or from the single center representative (download the statement here).

 

If you do not have existing consents, or you need new patient consents:

  • Make an application to your local/national data protection authorities for storing data on your local computer as well as exporting anonymous data to the ECFS. The following documents downloadable from this page will be needed for the application:
    ECFR Registration 
    ECFR Registration Terms 
    The Patient Information Sheet Template and Patient Consent Form Template must be changed to meet any requirements of your local legal and ethics laws, and translated to your own language.
  • When your application has been approved by your local data protection agency, please inform Jacqui van Rens (jacqueline.vanrens@uzleuven.be) along with a copy of the approval from your data protection authorities. This approval should be in English. If not we will need both the original document and a translation. Furthermore, we will need a signed statement from the country representative if you have a national registry (download the statement here), or from the centre representative (download the statement here).
  • Patients can only be entered into the registry once you have received their signed, informed consent to do so. Please store all the consent forms that your patients have signed safely in your local hospital.

 

It is the responsibility of the reporting centres/countries/registries to have the acquired permissions to export/report data to the European registry. It is the responsibility of the ECFS and the European registry steering committee to check these permissions before any data are received. It is the responsibility of the ECFS and the European registry steering committee that the data are stored and handled according to Danish, Italian and EU Data Protection laws. The ECFS Patient Registry is registered under the Danish Data Protection Agency, file no 2013-41-2105.

For questions concerning the above please feel free to contact Jacqui van Rens (jacqueline.vanrens@uzleuven.be)

FORMS:

Confirmation of Legal & Ethical Compliance to use the European Registry Software - for download (pdf)

REFERENCES:

The Danish Data Protection Agency can hereby confirm that the ECFS Patient Registry is governed by the Danish Act on Processing of Personal Data (Act No. 429 of 31 May 2000). The act implements Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 
For the full document: click here

Standard terms for a database for private research approved by the Danish Data Protection Agency.

AUTHORISATION to process personal data

The Data Protection Agency hereby grants authorisation for the implementation of the project, cf. section 50(1)(i) of the Danish Act on Processing of Personal Data. In this connection, the Data Protection Agency lays down the following terms:

General terms

Period of validity: The authorisation is valid until September 1, 2015

1. Hanne Vebert Olesen is responsible for compliance with these present terms.

2. The data can be used for the implementation of the project only.

3. Processing of personal data must be performed only by the controller or at the instance of the controller and at his responsibility.

4. Any person processing personal data must be cognizant of these present terms.

5. The terms must be complied with also where processing is made by a data processor. 

6. Facilities used for storage and processing of the data must be organized and fitted up in order to prevent unauthorized access.

7. Data processing must be organized in such a manner that data are protected against accidental or unlawful destruction, loss or impairment. Furthermore, the necessary control should be exercised to ensure that no inaccurate or misleading data are processed. Inaccurate or misleading data or data processed in contravention of the above Act or of these terms shall be rectified or erased.

8. Data must not be kept in a form that makes it possible to identify the data subject for a longer period than is necessary for the implementation of the project. 

9. If results from the project are published this must be done so that it is impossible to identify individual persons.

10. It is a condition compliance is made with related terms, if any, laid down in accordance with other legislation.

Electronic data

11. Identification data must be encrypted or replaced by a code number or the like. Alternatively, all data can be stored encrypted. Encryption keys, code keys etc. must be stored securely and separate from the personal data.

12. Access to project data can be obtained only through the use of a confidential password. A password must be replaced at least once a year and when conditions dictate it.

13. If data identifying individuals are transferred over the Internet or other external network, the necessary security measures must be taken to ensure that the data do not come to the knowledge of any unauthorized third parties. As a minimum, the data must be encrypted during transmission. Transmission of sensitive personal data requires strong encryption. When using internal networks, it must be ensured that unauthorized persons are unable to obtain access to the data.

14. Removable storage media, safety copies of data etc. must be stored securely and under lock and so that unauthorized access is prevented.

Manual data

15. Manual project material, including print-outs, failure lists and control lists etc., as well as other material which may directly or indirectly be linked with specific persons, must be stored securely under lock and so that unauthorized access is prevented.

Bio-bank and biological material 

16. Samples with biological material and biological material in bio-banks must be stored securely under lock so that unauthorized access is prevented and in such a manner that it is ensured that the material is not lost, impaired or accidentally or illegally destroyed.

17. Biological material marked with civil registration number (CPR-no.) or name must be stored subject to special safety requirements.

18. The project material shall contain internal guidelines for storage of biological material and the guidelines shall be updated at least once a year.

Data to be provided to the data subject

19. Where the personal data are to be obtained from the data subject (through interviews, questionnaires, clinical or para-clinical examination, treatment, observation etc.), detailed data about the project shall be distributed/forwarded to the data subject. The data subject must be informed of the name of the controller, the purpose of the project and of the fact that it is voluntary to participate and that consent may be withdrawn at any time. Where the data are to be disclosed to be used for other scientific or statistical purposes, the data subject shall be advised also of the purpose of the disclosure and the recipient's identity.

20. The data subject shall furthermore be advised that the project is notified to the Data Protection Agency in accordance with Act on Processing of Personal Data, and that the Agency has laid down specific terms to be complied with for the project for the purpose of protecting the data subject's privacy.

Right of access to personal data

21. The data subject has no right of access to the data being processed with regard to himself.

Disclosure 

22. Disclosure of data identifying individuals to a third party may take place for other statistical or scientific purposes only.

23. Disclosure may be made only subject to prior approval of the Data Protection Agency. The Data Protection Agency may lay down new terms for the disclosure as well as the recipient’s data processing.

24. Disclosure of data may furthermore take place if it appears from other legislation that the data shall be disclosed.

Processing by a data processor

25. The Data Protection Agency’s conditions shall apply also to processing made by a data processor.

26. When data are processed by a data processor, a written agreement shall be made between the controller and the data processor. The agreement shall stipulate that the data processor acts on behalf of the controller only and that the data must not be used for the data processor’s own purposes. The controller shall furthermore request sufficient data from the data processor to ensure that the Data Protection Agency’s terms can and will be complied with.

27. Where the data processor is established in another Member State it shall, furthermore, appear from the agreement that such other regulations on safety measures with regard to data processors that may be in force in the Member State in question, shall apply also to the data processor in question.

Changes of the project

28. The Data Protection Agency shall be notified of significant changes in relation to the project (in the form of a change to an existing notification). Less significant changes may be notified to the Data Protection Agency.

29. Changes, if any, of the final date of completion of the project shall always be notified.

Completion of the project

30. At the completion of the project at the latest the data shall be erased, be made anonymous, or be destroyed, so that subsequently it is not possible to identify individuals participating in the project.

31. Alternatively, the data may be transferred for further storage with the State’s Archives (including “Dansk Dataarkiv” - Danish Data Archives)

32. The controller shall inform the Data Protection Agency promptly when the project is completed and the data have been erased, made anonymous, destroyed or transferred to the State’s Archives.

33. Erasure of data from electronic media shall take place in such a manner that it is impossible to recover the data.

34. (Special terms for tests/ trials, etc.) After the completion of the project, data regarding the individual person may, however, if requested by an authority or if to comply with the GCP rules, be kept for the period of time required. A list of participating individuals can be kept as well for the same period of time.

Transfer of data to third countries

35. Transfer of data to third countries, including for the purpose of processing by a data processor and for internal application in the project, requires the Data Protection Agency’s prior approval.

36. Transfer may, however, take place without approval of the Data Protection Agency if the data subject has given his explicit consent. The data subject can withdraw his consent.

37. Transfer of data shall take place by courier or registered mail. In case of electronic transmission the necessary security measures shall be taken to prevent unauthorized access. As a minimum, the data must be safely encrypted during the entire transmission.

The above terms shall apply until further notice. The Data Protection Agency reserves the right to take up the terms and conditions for revision at a later date, if required.