Informed Consent – StatPearls – NCBI Bookshelf

Parth Shah; Imani Thornton; Danielle Turrin; John E. Hipskind.

Author Information and Affiliations

Last Update: June 11, 2022.

Introduction

Informed consent is the process in which a health care provider educates a patient about the risks, benefits, and alternatives of a given procedure or intervention. The patient must be competent to make a voluntary decision about whether to undergo the procedure or intervention.  Informed consent is both an ethical and legal obligation of medical practitioners in the US and originates from the patient’s right to direct what happens to their body. Implicit in providing informed consent is an assessment of the patient’s understanding, rendering an actual recommendation, and documentation of the process. The Joint Commission requires documentation of all the elements of informed consent “in a form, progress notes or elsewhere in the record.” The following are the required elements for documentation of the informed consent discussion: (1) the nature of the procedure, (2) the risks and benefits and the procedure, (3) reasonable alternatives, (4) risks and benefits of alternatives, and (5) assessment of the patient’s understanding of elements 1 through 4.

It is the obligation of the provider to make it clear that the patient is participating in the decision-making process and avoid making the patient feel forced to agree to with the provider. The provider must make a recommendation and provide their reasoning for said recommendation.[1][2][3]

Issues of Concern

Adequacy of Informed Consent

The required standard for informed consent is determined by the state. The three acceptable legal approaches to adequate informed consent are (1) Subjective standard: What would this patient need to know and understand to make an informed decision? (2) Reasonable patient standard: What would the average patient need to know to be an informed participant in the decision? (3) Reasonable physician standard: What would a typical physician say about this procedure?

Many states use the “reasonable patient standard” because it focuses on what a typical patient would need to know to understand the decision at hand. However, it is the sole obligation of the provider to determine which approach is appropriate for a given situation.[4][5][6][5]

Exceptions to Informed Consent

Several exceptions to the requirement for informed consent include (1) the patient is incapacitated, (2) life-threatening emergencies with inadequate time to obtain consent, and (3) voluntary waived consent.  If the patient’s ability to make decisions is questioned or unclear, an evaluation by a psychiatrist to determine competency may be requested. A situation may arise in which a patient cannot make decisions independently but has not designated a decision-maker. In this instance, the hierarchy of decision-makers, which is determined by each state’s laws, must be sought to determine the next legal surrogate decision-maker. If this is unsuccessful, a legal guardian may need to be appointed by the court.

Children and Informed Consent

Children (typically under 17) cannot provide informed consent.   As such, parents must permit treatments or interventions. In this case, it not termed “informed consent” but “informed permission.”  An exception to this rule is a legally emancipated child who may provide informed consent for himself. Some, but not all, examples of an emancipated minor include minors who are (1) under 18 and married, (2) serving in the military, (3) able to prove financial independence or (4) mothers of children (married or not). Legislation regarding minors and informed consent is state-based as well. It is important to understand the state laws.

Informed Consent for Blood Transfusion

Informed consent is essential to patient autonomy. Informed consent requires a thorough understanding of transfusions and the ability to convey this information to a patient in a way that they can understand it. However, obtaining consent often has deficiencies in the explanation where benefits may not be entirely true and risks related are omitted.[7]. It has been shown that involving experts from transfusion units in obtaining informed consent for transfusion results in patients having a better understanding of the risks and benefits. [8] However, always involving an expert may not be the most efficient way to obtain consent, although new graduate physicians have a knowledge deficit when it comes to transfusion medicine. However, physicians that had previous transfusion medicine education displayed more understanding than those who did not[9].  As most physicians will need to obtain informed consent for a transfusion at one point in their career, it could be argued that physicians should have enough education in regards to transfusion medicine.

The types of transfusions and their indications are:

1. Red blood cells

   • Acute blood loss of greater than 1,500 mL or 30% of blood volume or acute blood loss causing hemodynamic instability

   • Symptomatic anemia (myocardial ischemia, orthostatic hypotension, dyspnea at rest, tachycardia that is not responsive to fluid resuscitation) when hemoglobin is less than 10 g/dL

   • Hemoglobin of less than 7 g/dL in asymptomatic patients, hemodynamically stable patients in intensive care, and patients undergoing cardiovascular surgery[10][11][10]

   • Hemoglobin of less than 8 g/dL in patients with cardiovascular disease or postoperatively[12][13]

2. Fresh frozen plasma

   • Can be used for apheresis in thrombotic thrombocytopenic purpura or hemolytic uremic syndrome

   • Acute disseminated intravascular coagulopathy with active bleeding

   • Emergent reversal of warfarin in major or intracranial hemorrhage, prophylactically in an emergent surgical procedure

   • An International Normalized Ratio > 1. 6 in hereditary clotting factor deficiencies, preventing active bleeding in a patient on anticoagulants prior to an invasive procedure, or with active bleeding

3. Platelets

   • Platelet count of < 10,000/mL in stable patients without active bleeding

   • < 20,000/mL stable patients without active bleeding with fever or are undergoing an invasive procedure

   • < 50,000/mL in surgery with active bleeding

   • ≤ 50,000/mL in major surgery or invasive procedure without active bleeding

   • ≤ 100,000/mL in ocular surgery or neurosurgery without active bleeding

4. Cryoprecipitate

5. Massive transfusion protocol

Adverse effects of transfusions[14]:

• Acute hemolytic reaction

  • The recipient’s antibodies attack transfused red blood cells whether caused by a reaction to the ABO blood group or antibodies produced from previous transfusions. Acute hemolytic transfusions occur within 24 hours of transfusion. Symptoms include fever, nausea, vomiting, dyspnea, hypotension, bleeding, pain at the infusion site, oliguria, anuria, dyspnea, or chest or back pain.

• Allergic reaction

  • It can present ranging from mild to life-threatening allergic reactions. Patients with mild symptoms may present with hives. More severe reactions will present with hypotension, angioedema, stridor, respiratory distress, or shock. These symptoms usually present within seconds to minutes of beginning a transfusion.

• Febrile nonhemolytic reaction

  • A febrile nonhemolytic reaction is an increase in temperature of at least 1° Celcius during or shortly after a transfusion. It is caused by an inflammatory response to cytokines from the donor.

• Mistransfusion

  • This can occur if blood products are labeled incorrectly. This can be avoided by making sure the blood bank and the health care worker initiating the transfusion check the blood product to assure it is for the correct patient.

• Transfusion-associated circulatory overload

  • Transfusion-associated circulatory overload (TACO) is caused by the rapid infusion of blood products which overwhelms the recipient’s circulatory system. Patients may present with tachycardia, hypertension, dyspnea, and cough. Patients will have pulmonary edema on chest radiography as well as elevated brain natriuretic peptide levels.

• Transfusion-related acute lung injury

  • Transfusion-related acute lung injury (TRALI) is caused by an activation of the recipient’s immune system causing massive noncardiogenic pulmonary edema that causes hypoxemia. TRALI occurs within 6 hours of a transfusion. Patients will present with respiratory distress, usually within 1 to 2 hours of initiating a transfusion. Patients will have pulmonary infiltrates on chest radiography.

• Delayed hemolytic reaction

  • Delayed hemolytic reactions occur more than 24 hours after a transfusion is completed. They usually occur days to weeks after the transfusion. The symptoms of a delayed hemolytic reaction are often gradual and less severe compared to an acute reaction. 

• Over and under transfusion

• Transfusion-associated graft-versus-host disease

  • Transfusion-associated graft-versus-host disease (GVHD) is caused by donor lymphocytes in blood products proliferating and mounting an attack against the recipient’s tissues and organs. It is most common in immunocompromised or in patients receiving a transfusion with shared HLA haplotypes. Symptoms of transfusion-associated graft-versus-host disease are fever, diarrhea, rash, liver dysfunction, and pancytopenia. Transfusion-associated GVHD has a mortality rate of 90%.

• Transfusion-related immunomodulation

  • Transfusion-related immunomodulation is the immunosuppressive effect of transfused blood products leading to postoperative infection, tumor recurrence, and nosocomial infection in critically ill patients.  [15]

• Infection or contamination

Clinical Significance

Informed consent is required for many aspects of health care.[16][17][1] These include consent for:

1. Treatment, 

2. dissemination of patient information, 

3. discussion of HIPPA laws, 

4. specific procedures, 

5. surgery, 

6. blood transfusions, and 

7. anesthesia.  

Obtaining informed consent in medicine is process that should include: (1) describing the proposed intervention, (2) emphasizing the patient’s role in decision-making, (3) discussing alternatives to the proposed intervention, (4) discussing the risks of the proposed intervention and (5) eliciting the patient’s preference (usually by signature). Discussion of all risks is paramount to informed consent in this context. Most consent includes general risks, risks specific to the procedure, risks of no treatment and alternatives to treatment.   Additionally, many consent forms express that there are no guarantees that the proposed procedure will provide a cure to the problem being addressed.

Patient safety is a major focus in health care, and effective informed consent is considered a patient safety issue. The Joint Commission recently addressed the challenges to ensuring effective informed consent. The emphasis of a patient signature as an indication of understanding is being called into question. The process of informed consent is shifting to focus more on communication and less on signatures. Studies of informed consent have found that there are many barriers to obtaining effective informed consent. One major barrier is that some consent forms contain language that is at too high a reading level for many patients. Use of visual and digital communication tools is being encouraged to address some the inefficiencies in the process of obtaining consent. Patients should be actively engaged as a way to enhance communication and ensure patient safety and understanding.  

Informed consent may be waived in emergency situations if there is no time to obtain consent or if the patient is unable to communicate and no surrogate decision maker is available. Also, not every procedure requires explicit informed consent. For example taking a patient’s blood pressure is a part of many medical treatments. However, a discussion regarding the risks and benefits of using a sphygmomanometer usually is not required.

Clinical Significance in Human Clinical Studies

Informed consent is mandatory for all clinical trials involving human beings. The consent process must respect the patient’s ability to make decisions and adhere the individual hospital rules for clinical studies. Adherence to ethical standards in study design and execution is usually monitored by an Institutional Review Board (IRB). The IRB was established in the United States in 1974 by the National Research Act which called for regulation in human research that was prompted by questionable research tactics used in the Tuskegee syphillis experiments and others. Ethical and safe research standards have been an area of federal and presidential interest since then, with the development of many organizations and task forces since 1974 dedicated to this topic alone. Valid informed consent for research must include three major elements: (1) disclosure of information, (2) competency of the patient (or surrogate) to make a decision, and (3) voluntary nature of the decision. US federal regulations require a full, detailed explanation of the study and its potential risks. 

An IRB may waive informed consent if certain conditions are met.  Paramount to this is that there be ‘minimal risk’ to the research participants. One example of minimal risk research is the assessment of interventions that normally occur in emergency situations. Examples of this include studying medications used for intubations in the emergency room or conducting a retrospective chart review.

Shared Decision Making

Informed consent is a collaborative process allowing patients and healthcare providers to make decisions together when more than one reasonable alternative exists, accounting for the patient’s unique preferences and priorities and the best scientific evidence available.  

It is most appropriate in weighing the benefits and harms of invasive procedures, computed tomography (CT), and post-ED disposition including the use of thrombolytics for acute ischemic stroke, lumbar puncture to rule out subarachnoid hemorrhage, and CT for minor pediatric head injuries.

Shared decision-making (SDM) challenges in Emergency Medicine include patient, provider, system and evidence level limitations. Examples include: (1) if patients are capable of or willing to engage in decision making (2) if providers feel it provides more or less medico-legal protection, (3) if the Emergency Department is overwhelmed and time is of the essence to make decisions, and (4) if the facility lacks well-validated risk prediction tools to guide decision making.

Enhancing Healthcare Team Outcomes

As mentioned previously, there is a deficit in providing necessary information to patients when obtaining informed consent. Providers should be educated on common procedures and interventions from experts and should be able to relay this information to patients as well as other members of the healthcare team. Members of the healthcare team, such as nurses and patient care assistants, should also be educated about all potential adverse reactions so that they are able to identify them and notify a provider so that any immediate intervention that is needed can be performed in a timely manner. Members of the healthcare team involved with the care of a patient should also be informed about procedures and interventions as they may be used as witnesses in obtaining informed consent. They would be able to evaluate whether all necessary information was given to the patient and provide any information the provider obtaining informed consent may have forgotten.

Review Questions

• Access free multiple choice questions on this topic.

• Comment on this article.

References

1.

Slim K, Bazin JE. From informed consent to shared decision-making in surgery. J Visc Surg. 2019 Jun;156(3):181-184. [PubMed: 31101549]

2.

Edwards S. Review of a medical illustration department’s data processing system to confirm general data protection regulation (GDPR) compliance. J Vis Commun Med. 2019 Jul;42(3):140-143. [PubMed: 31088229]

3.

Williams CM, Nester C, Morrison SC. International approaches to paediatric podiatry curricula: It’s the same, but different. J Foot Ankle Res. 2019;12:28. [PMC free article: PMC6507174] [PubMed: 31086569]

4.

Boskey ER, Johnson JA, Harrison C, Marron JM, Abecassis L, Scobie-Carroll A, Willard J, Diamond DA, Taghinia AH, Ganor O. Ethical Issues Considered When Establishing a Pediatrics Gender Surgery Center. Pediatrics. 2019 Jun;143(6) [PubMed: 31085738]

5.

Xu J, Prince AER. Shared decision-making in vascular surgery. J Vasc Surg. 2019 Nov;70(5):1711-1715. [PubMed: 31068265]

6.

Krüger M. [On the judgment by the Federal Court of Justice on living organ donors]. Chirurg. 2019 Jun;90(6):496-500. [PubMed: 31069415]

7.

Friedman M, Arja W, Batra R, Daniel S, Hoehn D, Paniz AM, Selegean S, Slova D, Srivastava S, Vergara N. Informed consent for blood transfusion: what do medicine residents tell? What do patients understand? Am J Clin Pathol. 2012 Oct;138(4):559-65. [PubMed: 23010711]

8.

Furumaki H, Fujihara H, Yamada C, Watanabe H, Shibata H, Kaneko M, Nagai S, Ishizuka K, Tsuzuki M, Adachi M, Takeshita A. Involvement of transfusion unit staff in the informed consent process. Transfus Apher Sci. 2016 Feb;54(1):150-7. [PubMed: 26878975]

9.

O’Brien KL, Champeaux AL, Sundell ZE, Short MW, Roth BJ. Transfusion medicine knowledge in Postgraduate Year 1 residents. Transfusion. 2010 Aug;50(8):1649-53. [PubMed: 20345564]

10.

Hébert PC, Wells G, Blajchman MA, Marshall J, Martin C, Pagliarello G, Tweeddale M, Schweitzer I, Yetisir E. A multicenter, randomized, controlled clinical trial of transfusion requirements in critical care. Transfusion Requirements in Critical Care Investigators, Canadian Critical Care Trials Group. N Engl J Med. 1999 Feb 11;340(6):409-17. [PubMed: 9971864]

11.

Carson JL, Stanworth SJ, Alexander JH, Roubinian N, Fergusson DA, Triulzi DJ, Goodman SG, Rao SV, Doree C, Hebert PC. Clinical trials evaluating red blood cell transfusion thresholds: An updated systematic review and with additional focus on patients with cardiovascular disease. Am Heart J. 2018 Jun;200:96-101. [PubMed: 29898855]

12.

Docherty AB, O’Donnell R, Brunskill S, Trivella M, Doree C, Holst L, Parker M, Gregersen M, Pinheiro de Almeida J, Walsh TS, Stanworth SJ. Effect of restrictive versus liberal transfusion strategies on outcomes in patients with cardiovascular disease in a non-cardiac surgery setting: systematic review and meta-analysis. BMJ. 2016 Mar 29;352:i1351. [PMC free article: PMC4817242] [PubMed: 27026510]

13.

Carson JL, Terrin ML, Noveck H, Sanders DW, Chaitman BR, Rhoads GG, Nemo G, Dragert K, Beaupre L, Hildebrand K, Macaulay W, Lewis C, Cook DR, Dobbin G, Zakriya KJ, Apple FS, Horney RA, Magaziner J. , FOCUS Investigators. Liberal or restrictive transfusion in high-risk patients after hip surgery. N Engl J Med. 2011 Dec 29;365(26):2453-62. [PMC free article: PMC3268062] [PubMed: 22168590]

14.

Sharma S, Sharma P, Tyler LN. Transfusion of blood and blood products: indications and complications. Am Fam Physician. 2011 Mar 15;83(6):719-24. [PubMed: 21404983]

15.

Taylor RW, O’Brien J, Trottier SJ, Manganaro L, Cytron M, Lesko MF, Arnzen K, Cappadoro C, Fu M, Plisco MS, Sadaka FG, Veremakis C. Red blood cell transfusions and nosocomial infections in critically ill patients. Crit Care Med. 2006 Sep;34(9):2302-8; quiz 2309. [PubMed: 16849995]

16.

Pesut B, Thorne S, Stager ML, Schiller CJ, Penney C, Hoffman C, Greig M, Roussel J. Medical Assistance in Dying: A Review of Canadian Nursing Regulatory Documents. Policy Polit Nurs Pract. 2019 Aug;20(3):113-130. [PMC free article: PMC6827351] [PubMed: 31060478]

17.

Hewins W, Zienius K, Rogers JL, Kerrigan S, Bernstein M, Grant R. The Effects of Brain Tumours upon Medical Decision-Making Capacity. Curr Oncol Rep. 2019 May 02;21(6):55. [PMC free article: PMC6495430] [PubMed: 31049786]

Disclosure: Parth Shah declares no relevant financial relationships with ineligible companies.

Disclosure: Imani Thornton declares no relevant financial relationships with ineligible companies.

Disclosure: Danielle Turrin declares no relevant financial relationships with ineligible companies.

Disclosure: John Hipskind declares no relevant financial relationships with ineligible companies.

Informed Consent Requirements | National Institute of Justice

Informed consent is a process in which the researcher provides sufficient information, in an understandable format, to the research subjects so that they can make a voluntary decision whether or not to participate in the study. The informed consent process is fundamental in ensuring respect for persons and should serve to educate the subject about the research, the benefits and risks, and the voluntary nature of their participation. The informed consent should be in language understandable by the study subjects. The informed consent should also be revised when deficiencies are discovered or when additional information will improve the process. The regulations under section 28 CFR §46.116 describe the elements or information that must be contained in the informed consent provided to the study subjects. Below is a brief listing of the basic items to be included in the informed consent:

• A statement that the study involves research.
• The name(s) of the funding agency(ies).
• An explanation of the purposes of the research.
• The expected duration of the subject’s participation.
• A description of the procedures to be followed and what the subjects will be required to do in the study.
• Identification of any procedures which are experimental.
• A description of any reasonably foreseeable risks or discomforts to the subject. Risks are not limited to physical injury, but also include psychological, social, financial, legal, and others.
• A description of any benefits to the subject or to others that may reasonably be expected from the research; there may be none other than a sense of helping the public at large when balanced by the appropriate level of risk.
• A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject. In most NIJ studies the alternative will be to not participate in the study.
• A statement describing the extent to which confidentiality of records identifying the subject will be maintained. For studies sponsored by NIJ the subject should be informed that private, identifiable information will be kept confidential and will only be used for research and statistical purposes. If, due to sample size or some unique feature, the identity of the individual cannot be maintained, the subjects need to be explicitly notified. If the investigator intends to disclose any information, the subject needs to be explicitly informed what information would be disclosed, under what circumstances, and to whom. The subject must be informed of any potential risks which may result from this disclosure and must explicitly provide prior written consent.
• For research involving more than minimal risk[1], an explanation as to whether any compensation, and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained.
• An explanation of whom to contact for answers to questions about the research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject. This should include name and telephone number or other appropriate methods.
• A statement that participation is voluntary, that refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and that the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

28 CFR §46.117 Documentation of Informed Consent

As a general rule, informed consent should be documented by the use of a written consent form approved by the IRB, and signed by the subject or the subject’s legally authorized representative. A copy shall be given to the person signing the form.

An IRB may waive the requirements to obtain a signed consent form as described in section 46.117(c) if it determines:

1. That the only record linking the subject and the research would be the consent document, and the principal risk would be potential harm resulting from a breach of confidentiality. Each subject will be asked whether the subject wants documentation linking the subject with the research, and the subject’s wishes will govern; or
2. That the research presents no more than minimal risk of harm to subjects, and involves no procedures for which written consent is normally required outside of the research context. In cases in which the written consent documentation requirement is waived, the IRB may require the investigator to provide subjects with a written statement regarding the research and obtain their oral consent to participate.

Date Published: November 19, 2007

requirements from September 1, 2022

Obtaining consent to the processing of personal data refers to the process by which it is possible to obtain direct permission from individuals before processing their data.

While this document is one of the legal grounds for processing a citizen’s information, there are a number of situations in which consent is not required.

One of the most important criteria for the consent of a citizen to the processing of his personal data is the unambiguity and obviousness of such approval.

The request for consent must contain information about the purposes for which personal data will be used, as well as details of the company processing them.

The consent itself must be freely expressed, informed, specific, substantive, conscious and unambiguous.

The law defines as a personal data operator any natural or legal person who works with personal information.

For example, if users can register on the site, leave a request for a call, place an order, purchase a product, subscribe to a newsletter, etc., and for this they transmit data with which they can be identified, then the owner such a site falls under the regulation of the law “On the protection of personal data”.

It is also important to take into account that any employer is considered a personal data operator, therefore, for each employee, appropriate consent is required.

Requirements for consent to the processing of personal data have changed

From September 1, 2022, new rules apply to the consent form for the processing of personal data, for violation of which operators are liable.

Consent must be “specific, specific, informed, conscientious and unambiguous”.

The operator is not entitled to collect information if it does not relate to the specific purposes of its processing.

Separately, it should be noted that it is not allowed to receive excessive personal information, that is, not related to a specific operation: for example, when ordering shampoo in an online store, information about a citizen’s passport data will be redundant.

Innovations of September 2022 – what exactly should be in the consent to the processing of personal data

The consent form for the processing of personal data must contain the following information:
• FULL NAME. citizen, his address, as well as information about the identity document;
• If a citizen acts through a representative – information similar to paragraph 1, as well as details of a document confirming the authority of the person;
• Name/full name personal data operator;
• Purpose of personal data processing;
• List of data for which consent is provided;
• In the event that the processing is carried out on behalf of the operator – name / full name. and the address of the person concerned;
• Validity of consent to the processing of personal data, as well as the method of its withdrawal;
• Signature of the citizen who gave consent.

What are the types of consents, what types of data are given

The most important requirement for the document is the ability to identify the person who gave the consent, as well as establishing a list of information and purposes for which the consent was given.

There are several types of consents to the processing of personal data, which include:
• Consent in writing;
• Consent in a simple electronic form;
• Consent in qualified electronic form.

In addition to various types of consents, there are also several types of personal data themselves: general (full name, information about documents, address, etc.), biometric (information that characterizes the physiological and biological characteristics of a person, on the basis of which you can to establish his identity), special (information about the state of health, religion, political views, nationality, race, etc.).

In addition, from March 1, 2021, new rules for interacting with data that are publicly available will apply.

By publicly available data we mean personal data that is disclosed to an indefinite circle of persons (for example, published on the Internet).

Consent is also required for the processing of such data. Such consent must be made separately from other consents.

From September 1, 2021, Roskomnadzor imposes special requirements on the content of consent to the processing of publicly available personal data.

It is worth noting that if it is necessary to transfer the received data to third parties, the consent must expressly indicate this possibility.

In view of the fact that the wording of consent is only being developed, Roskomnadzor offers to use a service that allows the operator to prepare a template for the consent form for the processing of personal data authorized by the subject of personal data for distribution, taking into account the professional specifics of the operator’s activities.

Consent to the processing of publicly available personal data can be given in two ways:
1. Directly by the subject of personal data to the operator.
2. From March 1, 2022 – through the information system of Roskomnadzor in accordance with this order.

Features of consent to cross-border transfer of personal data

This type of transfer of data about citizens is a procedure in which information is transferred to the authorities of a foreign state, as well as to a foreign individual or legal entity.

The law establishes a number of requirements that such a transfer may only take place with consent; international treaty; execution of an agreement with the participation of a citizen; protection of the life and health of the citizen himself or other persons if it is impossible to obtain consent in writing.

In cases where a company operates on the Internet without having a physical presence in Russia, if its activities are directed to Russia, it must comply with the requirements of the law.

That is, it is possible to collect, process and store a database of personal data about Russian citizens only on servers located in the Russian Federation. If the site is located on a foreign hosting, and at the same time data on citizens of the Russian Federation are collected and processed, the domain may be included in the register of violators of the rights of data subjects. The registry is maintained by Roskomnadzor.

The main feature of this type of transfer is that, in addition to informing the citizen about the upcoming transfer, it is necessary to notify Roskomnadzor, as well as to ensure the protection of the personal data transfer channel.

What to do first

In order to strictly comply with legal requirements, the following can be recommended:
• place on your site an agreement on the processing of personal data, after reading which the user of the site can express his consent to the processing of personal data;
• Request only necessary data. For example, a simple e-mail newsletter subscription is unlikely to require passport data;
• provide individuals with information about what data about him is stored in databases, why the data received from him is processed and to whom they are transferred;
• delete all information about the user after receiving the appropriate request;
• store personal data in a place that excludes access by third parties;
• develop a regulation on the processing of personal data, which must be signed by employees;
• Register as a personal data operator with Roskomnadzor.

In addition, the personal data operator needs to update the consent templates taking into account new legal requirements.

It is necessary to formulate the text of consent in such a way that it contains information about the purpose of data processing in each specific case.

Taking into account that the goals can be different, it is possible to draw up different templates: general and a number of special ones.

rules and nuances of design – Kontur.Extern

September 26, 2022 21 200

Consent to the processing of personal data – a written or digital document that confirms the voluntary decision of a citizen to transfer his personal information to the operator for certain purposes. According to Law No. 152-FZ, the operator must receive it in most cases. Let’s figure out when a permit for processing PD is required, and what are the requirements for it in 2022.

Contents

• What does the law say
• In which cases consent to processing is not required
• How to draw up a document
• How to apply for permission to distribute PD

Consent to the processing of personal data in 2022 must be specific, substantive, informed, conscious and unambiguous (Article 9 of Federal Law No. 152-FZ of July 27, 2006). This means that it contains:

• the specific purpose of processing – for example, to formalize an employment relationship;
• list of PD – for example, full name, date of birth, information about education, place of work, address;
• list of actions with personal data – for example, collection, storage;
• place and methods of processing PD – address of the operator, automated or non-automated processing;
• duration of the consent;
• name, full name, address of the person who processes the PD, if the operator entrusts it to another person;
• clearly expressed consent of the citizen – signature, tick or other mark.

By default, any actions with personal information without the consent of the subject or legal grounds are not allowed (Art. 6, 9152-FZ). At the same time, the document for the distribution of PD is drawn up separately (Art. 10.1 152-FZ).

Consent is obtained specifically for each purpose. That is, the operator will have several documents. This follows from part 4 of Art. 9 152-FZ, where the purpose is indicated in the singular, as well as from the requirement not to store information for incompatible purposes in one database (part 3 of article 5 152-FZ).

You can work with personal data only on legal grounds (Art. 5 152-FZ). Processing without the permission of the subject is allowed in cases provided for by international treaties or regulatory legal acts (part 1 of article 6, part 2 of article 10, part 2 of article 11 152-FZ). For example:

• personal information is processed with the participation of an individual in a lawsuit;
• a citizen registers on the State Services portal;
• information is needed to fulfill the terms of an agreement with a PD subject;
• special personal data, for example, about the state of health, are processed in accordance with labor, social or pension legislation.

A citizen has the right to revoke the given consent to PD processing at any time. In this case, actions with his personal information can only be continued if there are the above legal grounds. The obligation to prove the legality of processing: to provide the consent of a citizen or a separate rule of law, is assigned to the operator (part 2 of article 9152-FZ).

Employers should remember that the processing of biometric personal data of employees within the framework of labor relations is possible only with the written consent of the employee (Article 11 152-FZ). It is not needed for special and public PD. This means that full name, information about education are processed freely. But video surveillance of an employee is possible only with his written permission.

The law allows obtaining the consent of an individual to process his PD in any form. The main thing is to confirm that it exists and is given precisely by the subject of personal data or his representative (part 1 of article 9152-FZ). That is, theoretically, consent can be issued even in the form of a recording on a voice recorder, if the identity of a citizen is accurately identified by it.

If, according to the Law, consent must be made in writing – for example, for the processing of biometric data, then an electronic document with an electronic signature (ES) is recognized as equivalent to a paper original with a personal signature of the subject (part 4 of article 9 152-FZ). The main thing is that the electronic signature complies with the requirements (Order of the FSB of Russia dated December 27, 2011 No. 796).

A convenient service for preparing and submitting reports via the Internet. We give access to External for 14 days!

try

There is no approved consent form for PD processing. General requirements for its content are given in Article 9 152-FZ.

Many samples of consent are available on the Internet, for example, on the website of the Roskomnadzor Office of the Siberian Federal District. They must be used carefully, taking into account changes in Law 152-FZ:

• one purpose of processing – one consent;
• permission to distribute PD is issued separately.

A person who processes PD on behalf of an operator does not receive the consent of the subject (part 4 of article 6 of 152-FZ).

In some cases, the operator discloses personal data to an indefinite circle of persons. For example, it publishes a customer review on the website containing full name, email and other personal information. Or helps the customer to get a loan and sends an application on his behalf to various banks and MFIs.

This is called the dissemination of personal data, for which you need to obtain a separate consent of the subject of the PD (part 1 of article 10.1 of 152-FZ). The requirements for the content of such a permit are determined by Roskomnadzor (Order No. 18 dated February 24, 2021).

Submit all reports via the Internet – with tips and error checking

try

Consent to distribution can be issued in two ways (part 6 of article 10. 1 152-FZ):

• transferred by the subject directly to the operator;
• filled out using the information system of Roskomnadzor.

In the first case, the operator can get a document template on the Roskomnadzor website. To prepare a permit adapted for a specific activity, you will need a verified account on the portal of the State Services of an organization, individual entrepreneur or individual.

A request is generated on the Roskomnadzor portal through the ESIA. As a result, the operator gets access to the consent form for the distribution of PD, which he fills out taking into account his specifics. The finished template can be sent for verification to Roskomnadzor and receive its recommendations.

The consent form for the distribution of PD can be prepared using the information resource of Roskomnadzor.

If the operator decides to develop his own form, then he must indicate in it the mandatory items according to Order No.