Consent requirements. Informed Consent in Healthcare: Requirements, Standards, and Exceptions
What are the key elements of informed consent in healthcare. How does the process of obtaining informed consent work. What are the legal standards for adequate informed consent. When can informed consent be waived in medical situations. How does informed consent apply to minors and blood transfusions.
The Fundamentals of Informed Consent in Healthcare
Informed consent is a crucial ethical and legal obligation for medical practitioners in the United States. It stems from the patient’s fundamental right to make decisions about their own body and medical care. The process involves healthcare providers educating patients about the risks, benefits, and alternatives of proposed procedures or interventions.
To provide valid informed consent, a patient must:
- Be competent to make decisions
- Understand the information presented
- Make a voluntary decision without coercion
The Joint Commission mandates documentation of all elements of informed consent in the patient’s medical record. This documentation must include:
- The nature of the procedure
- Risks and benefits of the procedure
- Reasonable alternatives
- Risks and benefits of alternatives
- Assessment of the patient’s understanding
Healthcare providers must emphasize the patient’s active role in the decision-making process and avoid any perception of forcing agreement. Additionally, providers should offer clear recommendations along with their reasoning.
Legal Standards for Adequate Informed Consent
The required standard for informed consent varies by state. There are three primary legal approaches to determining the adequacy of informed consent:
- Subjective standard
- Reasonable patient standard
- Reasonable physician standard
The subjective standard focuses on what a specific patient needs to know to make an informed decision. The reasonable patient standard considers what an average patient would need to understand. The reasonable physician standard is based on what a typical physician would disclose about a procedure.
Many states adopt the “reasonable patient standard” as it centers on the information needs of a typical patient. However, healthcare providers must determine which approach is most appropriate for each unique situation.
How do these standards impact patient care?
The choice of standard can significantly influence the depth and breadth of information provided to patients. For example, under the subjective standard, a provider might need to tailor their explanation based on a patient’s educational background or personal concerns. In contrast, the reasonable patient standard would require a more standardized approach to information sharing across all patients.
Exceptions to Informed Consent Requirements
While informed consent is a critical component of ethical medical practice, there are several situations where it may not be required or possible:
- Patient incapacitation
- Life-threatening emergencies with insufficient time for consent
- Voluntary waiver of consent by the patient
In cases where a patient’s decision-making capacity is uncertain, a psychiatric evaluation may be necessary to determine competency. If a patient is unable to make decisions independently and has not designated a decision-maker, healthcare providers must follow state-specific hierarchies to identify the next legal surrogate decision-maker. In some instances, a court-appointed legal guardian may be required.
How are emergency situations handled in terms of consent?
In life-threatening emergencies where there is insufficient time to obtain informed consent, healthcare providers may proceed with necessary treatments under the principle of implied consent. This assumes that a reasonable person would consent to life-saving interventions if they were able to do so. However, providers must document the emergency nature of the situation and the reasons for proceeding without explicit consent.
Informed Consent and Minors: Special Considerations
Children under the age of 17 typically cannot provide informed consent for medical procedures. Instead, parents or legal guardians must give “informed permission” for treatments or interventions involving minors. However, there are exceptions to this rule, such as in the case of legally emancipated minors.
Examples of emancipated minors who may provide their own informed consent include:
Informed Consent – StatPearls – NCBI Bookshelf
Parth Shah; Imani Thornton; Danielle Turrin; John E. Hipskind.
Author Information and Affiliations
Last Update: June 11, 2022.
Introduction
Informed consent is the process in which a health care provider educates a patient about the risks, benefits, and alternatives of a given procedure or intervention. The patient must be competent to make a voluntary decision about whether to undergo the procedure or intervention. Informed consent is both an ethical and legal obligation of medical practitioners in the US and originates from the patient’s right to direct what happens to their body. Implicit in providing informed consent is an assessment of the patient’s understanding, rendering an actual recommendation, and documentation of the process. The Joint Commission requires documentation of all the elements of informed consent “in a form, progress notes or elsewhere in the record.” The following are the required elements for documentation of the informed consent discussion: (1) the nature of the procedure, (2) the risks and benefits and the procedure, (3) reasonable alternatives, (4) risks and benefits of alternatives, and (5) assessment of the patient’s understanding of elements 1 through 4.
It is the obligation of the provider to make it clear that the patient is participating in the decision-making process and avoid making the patient feel forced to agree to with the provider. The provider must make a recommendation and provide their reasoning for said recommendation.[1][2][3]
Issues of Concern
Adequacy of Informed Consent
The required standard for informed consent is determined by the state. The three acceptable legal approaches to adequate informed consent are (1) Subjective standard: What would this patient need to know and understand to make an informed decision? (2) Reasonable patient standard: What would the average patient need to know to be an informed participant in the decision? (3) Reasonable physician standard: What would a typical physician say about this procedure?
Many states use the “reasonable patient standard” because it focuses on what a typical patient would need to know to understand the decision at hand. However, it is the sole obligation of the provider to determine which approach is appropriate for a given situation.[4][5][6][5]
Exceptions to Informed Consent
Several exceptions to the requirement for informed consent include (1) the patient is incapacitated, (2) life-threatening emergencies with inadequate time to obtain consent, and (3) voluntary waived consent. If the patient’s ability to make decisions is questioned or unclear, an evaluation by a psychiatrist to determine competency may be requested. A situation may arise in which a patient cannot make decisions independently but has not designated a decision-maker. In this instance, the hierarchy of decision-makers, which is determined by each state’s laws, must be sought to determine the next legal surrogate decision-maker. If this is unsuccessful, a legal guardian may need to be appointed by the court.
Children and Informed Consent
Children (typically under 17) cannot provide informed consent. As such, parents must permit treatments or interventions. In this case, it not termed “informed consent” but “informed permission.” An exception to this rule is a legally emancipated child who may provide informed consent for himself. Some, but not all, examples of an emancipated minor include minors who are (1) under 18 and married, (2) serving in the military, (3) able to prove financial independence or (4) mothers of children (married or not). Legislation regarding minors and informed consent is state-based as well. It is important to understand the state laws.
Informed Consent for Blood Transfusion
Informed consent is essential to patient autonomy. Informed consent requires a thorough understanding of transfusions and the ability to convey this information to a patient in a way that they can understand it. However, obtaining consent often has deficiencies in the explanation where benefits may not be entirely true and risks related are omitted.[7]. It has been shown that involving experts from transfusion units in obtaining informed consent for transfusion results in patients having a better understanding of the risks and benefits. [8] However, always involving an expert may not be the most efficient way to obtain consent, although new graduate physicians have a knowledge deficit when it comes to transfusion medicine. However, physicians that had previous transfusion medicine education displayed more understanding than those who did not[9]. As most physicians will need to obtain informed consent for a transfusion at one point in their career, it could be argued that physicians should have enough education in regards to transfusion medicine.
The types of transfusions and their indications are:
- Red blood cells
Acute blood loss of greater than 1,500 mL or 30% of blood volume or acute blood loss causing hemodynamic instability
Symptomatic anemia (myocardial ischemia, orthostatic hypotension, dyspnea at rest, tachycardia that is not responsive to fluid resuscitation) when hemoglobin is less than 10 g/dL
Hemoglobin of less than 7 g/dL in asymptomatic patients, hemodynamically stable patients in intensive care, and patients undergoing cardiovascular surgery[10][11][10]
Hemoglobin of less than 8 g/dL in patients with cardiovascular disease or postoperatively[12][13]
- Fresh frozen plasma
Can be used for apheresis in thrombotic thrombocytopenic purpura or hemolytic uremic syndrome
Acute disseminated intravascular coagulopathy with active bleeding
Emergent reversal of warfarin in major or intracranial hemorrhage, prophylactically in an emergent surgical procedure
An International Normalized Ratio > 1. 6 in hereditary clotting factor deficiencies, preventing active bleeding in a patient on anticoagulants prior to an invasive procedure, or with active bleeding
- Platelets
Platelet count of < 10,000/mL in stable patients without active bleeding
< 20,000/mL stable patients without active bleeding with fever or are undergoing an invasive procedure
< 50,000/mL in surgery with active bleeding
≤ 50,000/mL in major surgery or invasive procedure without active bleeding
≤ 100,000/mL in ocular surgery or neurosurgery without active bleeding
- Cryoprecipitate
Massive transfusion protocol
Adverse effects of transfusions[14]:
- Acute hemolytic reaction
The recipient’s antibodies attack transfused red blood cells whether caused by a reaction to the ABO blood group or antibodies produced from previous transfusions. Acute hemolytic transfusions occur within 24 hours of transfusion. Symptoms include fever, nausea, vomiting, dyspnea, hypotension, bleeding, pain at the infusion site, oliguria, anuria, dyspnea, or chest or back pain.
- Allergic reaction
It can present ranging from mild to life-threatening allergic reactions. Patients with mild symptoms may present with hives. More severe reactions will present with hypotension, angioedema, stridor, respiratory distress, or shock. These symptoms usually present within seconds to minutes of beginning a transfusion.
- Febrile nonhemolytic reaction
A febrile nonhemolytic reaction is an increase in temperature of at least 1° Celcius during or shortly after a transfusion. It is caused by an inflammatory response to cytokines from the donor.
- Mistransfusion
This can occur if blood products are labeled incorrectly. This can be avoided by making sure the blood bank and the health care worker initiating the transfusion check the blood product to assure it is for the correct patient.
- Transfusion-associated circulatory overload
Transfusion-associated circulatory overload (TACO) is caused by the rapid infusion of blood products which overwhelms the recipient’s circulatory system. Patients may present with tachycardia, hypertension, dyspnea, and cough. Patients will have pulmonary edema on chest radiography as well as elevated brain natriuretic peptide levels.
- Transfusion-related acute lung injury
Transfusion-related acute lung injury (TRALI) is caused by an activation of the recipient’s immune system causing massive noncardiogenic pulmonary edema that causes hypoxemia. TRALI occurs within 6 hours of a transfusion. Patients will present with respiratory distress, usually within 1 to 2 hours of initiating a transfusion. Patients will have pulmonary infiltrates on chest radiography.
- Delayed hemolytic reaction
Delayed hemolytic reactions occur more than 24 hours after a transfusion is completed. They usually occur days to weeks after the transfusion. The symptoms of a delayed hemolytic reaction are often gradual and less severe compared to an acute reaction.
Over and under transfusion
- Transfusion-associated graft-versus-host disease
Transfusion-associated graft-versus-host disease (GVHD) is caused by donor lymphocytes in blood products proliferating and mounting an attack against the recipient’s tissues and organs. It is most common in immunocompromised or in patients receiving a transfusion with shared HLA haplotypes. Symptoms of transfusion-associated graft-versus-host disease are fever, diarrhea, rash, liver dysfunction, and pancytopenia. Transfusion-associated GVHD has a mortality rate of 90%.
- Transfusion-related immunomodulation
Transfusion-related immunomodulation is the immunosuppressive effect of transfused blood products leading to postoperative infection, tumor recurrence, and nosocomial infection in critically ill patients. [15]
Infection or contamination
Clinical Significance
Informed consent is required for many aspects of health care.[16][17][1] These include consent for:
Treatment,
dissemination of patient information,
discussion of HIPPA laws,
specific procedures,
surgery,
blood transfusions, and
anesthesia.
Obtaining informed consent in medicine is process that should include: (1) describing the proposed intervention, (2) emphasizing the patient’s role in decision-making, (3) discussing alternatives to the proposed intervention, (4) discussing the risks of the proposed intervention and (5) eliciting the patient’s preference (usually by signature). Discussion of all risks is paramount to informed consent in this context. Most consent includes general risks, risks specific to the procedure, risks of no treatment and alternatives to treatment. Additionally, many consent forms express that there are no guarantees that the proposed procedure will provide a cure to the problem being addressed.
Patient safety is a major focus in health care, and effective informed consent is considered a patient safety issue. The Joint Commission recently addressed the challenges to ensuring effective informed consent. The emphasis of a patient signature as an indication of understanding is being called into question. The process of informed consent is shifting to focus more on communication and less on signatures. Studies of informed consent have found that there are many barriers to obtaining effective informed consent. One major barrier is that some consent forms contain language that is at too high a reading level for many patients. Use of visual and digital communication tools is being encouraged to address some the inefficiencies in the process of obtaining consent. Patients should be actively engaged as a way to enhance communication and ensure patient safety and understanding.
Informed consent may be waived in emergency situations if there is no time to obtain consent or if the patient is unable to communicate and no surrogate decision maker is available. Also, not every procedure requires explicit informed consent. For example taking a patient’s blood pressure is a part of many medical treatments. However, a discussion regarding the risks and benefits of using a sphygmomanometer usually is not required.
Clinical Significance in Human Clinical Studies
Informed consent is mandatory for all clinical trials involving human beings. The consent process must respect the patient’s ability to make decisions and adhere the individual hospital rules for clinical studies. Adherence to ethical standards in study design and execution is usually monitored by an Institutional Review Board (IRB). The IRB was established in the United States in 1974 by the National Research Act which called for regulation in human research that was prompted by questionable research tactics used in the Tuskegee syphillis experiments and others. Ethical and safe research standards have been an area of federal and presidential interest since then, with the development of many organizations and task forces since 1974 dedicated to this topic alone. Valid informed consent for research must include three major elements: (1) disclosure of information, (2) competency of the patient (or surrogate) to make a decision, and (3) voluntary nature of the decision. US federal regulations require a full, detailed explanation of the study and its potential risks.
An IRB may waive informed consent if certain conditions are met. Paramount to this is that there be ‘minimal risk’ to the research participants. One example of minimal risk research is the assessment of interventions that normally occur in emergency situations. Examples of this include studying medications used for intubations in the emergency room or conducting a retrospective chart review.
Shared Decision Making
Informed consent is a collaborative process allowing patients and healthcare providers to make decisions together when more than one reasonable alternative exists, accounting for the patient’s unique preferences and priorities and the best scientific evidence available.
It is most appropriate in weighing the benefits and harms of invasive procedures, computed tomography (CT), and post-ED disposition including the use of thrombolytics for acute ischemic stroke, lumbar puncture to rule out subarachnoid hemorrhage, and CT for minor pediatric head injuries.
Shared decision-making (SDM) challenges in Emergency Medicine include patient, provider, system and evidence level limitations. Examples include: (1) if patients are capable of or willing to engage in decision making (2) if providers feel it provides more or less medico-legal protection, (3) if the Emergency Department is overwhelmed and time is of the essence to make decisions, and (4) if the facility lacks well-validated risk prediction tools to guide decision making.
Enhancing Healthcare Team Outcomes
As mentioned previously, there is a deficit in providing necessary information to patients when obtaining informed consent. Providers should be educated on common procedures and interventions from experts and should be able to relay this information to patients as well as other members of the healthcare team. Members of the healthcare team, such as nurses and patient care assistants, should also be educated about all potential adverse reactions so that they are able to identify them and notify a provider so that any immediate intervention that is needed can be performed in a timely manner. Members of the healthcare team involved with the care of a patient should also be informed about procedures and interventions as they may be used as witnesses in obtaining informed consent. They would be able to evaluate whether all necessary information was given to the patient and provide any information the provider obtaining informed consent may have forgotten.
Review Questions
Access free multiple choice questions on this topic.
Comment on this article.
References
- 1.
Slim K, Bazin JE. From informed consent to shared decision-making in surgery. J Visc Surg. 2019 Jun;156(3):181-184. [PubMed: 31101549]
- 2.
Edwards S. Review of a medical illustration department’s data processing system to confirm general data protection regulation (GDPR) compliance. J Vis Commun Med. 2019 Jul;42(3):140-143. [PubMed: 31088229]
- 3.
Williams CM, Nester C, Morrison SC. International approaches to paediatric podiatry curricula: It’s the same, but different. J Foot Ankle Res. 2019;12:28. [PMC free article: PMC6507174] [PubMed: 31086569]
- 4.
Boskey ER, Johnson JA, Harrison C, Marron JM, Abecassis L, Scobie-Carroll A, Willard J, Diamond DA, Taghinia AH, Ganor O. Ethical Issues Considered When Establishing a Pediatrics Gender Surgery Center. Pediatrics. 2019 Jun;143(6) [PubMed: 31085738]
- 5.
Xu J, Prince AER. Shared decision-making in vascular surgery. J Vasc Surg. 2019 Nov;70(5):1711-1715. [PubMed: 31068265]
- 6.
Krüger M. [On the judgment by the Federal Court of Justice on living organ donors]. Chirurg. 2019 Jun;90(6):496-500. [PubMed: 31069415]
- 7.
Friedman M, Arja W, Batra R, Daniel S, Hoehn D, Paniz AM, Selegean S, Slova D, Srivastava S, Vergara N. Informed consent for blood transfusion: what do medicine residents tell? What do patients understand? Am J Clin Pathol. 2012 Oct;138(4):559-65. [PubMed: 23010711]
- 8.
Furumaki H, Fujihara H, Yamada C, Watanabe H, Shibata H, Kaneko M, Nagai S, Ishizuka K, Tsuzuki M, Adachi M, Takeshita A. Involvement of transfusion unit staff in the informed consent process. Transfus Apher Sci. 2016 Feb;54(1):150-7. [PubMed: 26878975]
- 9.
O’Brien KL, Champeaux AL, Sundell ZE, Short MW, Roth BJ. Transfusion medicine knowledge in Postgraduate Year 1 residents. Transfusion. 2010 Aug;50(8):1649-53. [PubMed: 20345564]
- 10.
Hébert PC, Wells G, Blajchman MA, Marshall J, Martin C, Pagliarello G, Tweeddale M, Schweitzer I, Yetisir E. A multicenter, randomized, controlled clinical trial of transfusion requirements in critical care. Transfusion Requirements in Critical Care Investigators, Canadian Critical Care Trials Group. N Engl J Med. 1999 Feb 11;340(6):409-17. [PubMed: 9971864]
- 11.
Carson JL, Stanworth SJ, Alexander JH, Roubinian N, Fergusson DA, Triulzi DJ, Goodman SG, Rao SV, Doree C, Hebert PC. Clinical trials evaluating red blood cell transfusion thresholds: An updated systematic review and with additional focus on patients with cardiovascular disease. Am Heart J. 2018 Jun;200:96-101. [PubMed: 29898855]
- 12.
Docherty AB, O’Donnell R, Brunskill S, Trivella M, Doree C, Holst L, Parker M, Gregersen M, Pinheiro de Almeida J, Walsh TS, Stanworth SJ. Effect of restrictive versus liberal transfusion strategies on outcomes in patients with cardiovascular disease in a non-cardiac surgery setting: systematic review and meta-analysis. BMJ. 2016 Mar 29;352:i1351. [PMC free article: PMC4817242] [PubMed: 27026510]
- 13.
Carson JL, Terrin ML, Noveck H, Sanders DW, Chaitman BR, Rhoads GG, Nemo G, Dragert K, Beaupre L, Hildebrand K, Macaulay W, Lewis C, Cook DR, Dobbin G, Zakriya KJ, Apple FS, Horney RA, Magaziner J. , FOCUS Investigators. Liberal or restrictive transfusion in high-risk patients after hip surgery. N Engl J Med. 2011 Dec 29;365(26):2453-62. [PMC free article: PMC3268062] [PubMed: 22168590]
- 14.
Sharma S, Sharma P, Tyler LN. Transfusion of blood and blood products: indications and complications. Am Fam Physician. 2011 Mar 15;83(6):719-24. [PubMed: 21404983]
- 15.
Taylor RW, O’Brien J, Trottier SJ, Manganaro L, Cytron M, Lesko MF, Arnzen K, Cappadoro C, Fu M, Plisco MS, Sadaka FG, Veremakis C. Red blood cell transfusions and nosocomial infections in critically ill patients. Crit Care Med. 2006 Sep;34(9):2302-8; quiz 2309. [PubMed: 16849995]
- 16.
Pesut B, Thorne S, Stager ML, Schiller CJ, Penney C, Hoffman C, Greig M, Roussel J. Medical Assistance in Dying: A Review of Canadian Nursing Regulatory Documents. Policy Polit Nurs Pract. 2019 Aug;20(3):113-130. [PMC free article: PMC6827351] [PubMed: 31060478]
- 17.
Hewins W, Zienius K, Rogers JL, Kerrigan S, Bernstein M, Grant R. The Effects of Brain Tumours upon Medical Decision-Making Capacity. Curr Oncol Rep. 2019 May 02;21(6):55. [PMC free article: PMC6495430] [PubMed: 31049786]
Disclosure: Parth Shah declares no relevant financial relationships with ineligible companies.
Disclosure: Imani Thornton declares no relevant financial relationships with ineligible companies.
Disclosure: Danielle Turrin declares no relevant financial relationships with ineligible companies.
Disclosure: John Hipskind declares no relevant financial relationships with ineligible companies.
Informed Consent Requirements | National Institute of Justice
Informed consent is a process in which the researcher provides sufficient information, in an understandable format, to the research subjects so that they can make a voluntary decision whether or not to participate in the study. The informed consent process is fundamental in ensuring respect for persons and should serve to educate the subject about the research, the benefits and risks, and the voluntary nature of their participation. The informed consent should be in language understandable by the study subjects. The informed consent should also be revised when deficiencies are discovered or when additional information will improve the process. The regulations under section 28 CFR §46.116 describe the elements or information that must be contained in the informed consent provided to the study subjects. Below is a brief listing of the basic items to be included in the informed consent:
- A statement that the study involves research.
- The name(s) of the funding agency(ies).
- An explanation of the purposes of the research.
- The expected duration of the subject’s participation.
- A description of the procedures to be followed and what the subjects will be required to do in the study.
- Identification of any procedures which are experimental.
- A description of any reasonably foreseeable risks or discomforts to the subject. Risks are not limited to physical injury, but also include psychological, social, financial, legal, and others.
- A description of any benefits to the subject or to others that may reasonably be expected from the research; there may be none other than a sense of helping the public at large when balanced by the appropriate level of risk.
- A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject. In most NIJ studies the alternative will be to not participate in the study.
- A statement describing the extent to which confidentiality of records identifying the subject will be maintained. For studies sponsored by NIJ the subject should be informed that private, identifiable information will be kept confidential and will only be used for research and statistical purposes. If, due to sample size or some unique feature, the identity of the individual cannot be maintained, the subjects need to be explicitly notified. If the investigator intends to disclose any information, the subject needs to be explicitly informed what information would be disclosed, under what circumstances, and to whom. The subject must be informed of any potential risks which may result from this disclosure and must explicitly provide prior written consent.
- For research involving more than minimal risk[1], an explanation as to whether any compensation, and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained.
- An explanation of whom to contact for answers to questions about the research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject. This should include name and telephone number or other appropriate methods.
- A statement that participation is voluntary, that refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and that the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.
28 CFR §46.117 Documentation of Informed Consent
As a general rule, informed consent should be documented by the use of a written consent form approved by the IRB, and signed by the subject or the subject’s legally authorized representative. A copy shall be given to the person signing the form.
An IRB may waive the requirements to obtain a signed consent form as described in section 46.117(c) if it determines:
- That the only record linking the subject and the research would be the consent document, and the principal risk would be potential harm resulting from a breach of confidentiality. Each subject will be asked whether the subject wants documentation linking the subject with the research, and the subject’s wishes will govern; or
- That the research presents no more than minimal risk of harm to subjects, and involves no procedures for which written consent is normally required outside of the research context. In cases in which the written consent documentation requirement is waived, the IRB may require the investigator to provide subjects with a written statement regarding the research and obtain their oral consent to participate.
Date Published: November 19, 2007
requirements from September 1, 2022
Obtaining consent to the processing of personal data refers to the process by which it is possible to obtain direct permission from individuals before processing their data.
While this document is one of the legal grounds for processing a citizen’s information, there are a number of situations in which consent is not required.
One of the most important criteria for the consent of a citizen to the processing of his personal data is the unambiguity and obviousness of such approval.
The request for consent must contain information about the purposes for which personal data will be used, as well as details of the company processing them.
The consent itself must be freely expressed, informed, specific, substantive, conscious and unambiguous.
The law defines as a personal data operator any natural or legal person who works with personal information.
For example, if users can register on the site, leave a request for a call, place an order, purchase a product, subscribe to a newsletter, etc., and for this they transmit data with which they can be identified, then the owner such a site falls under the regulation of the law “On the protection of personal data”.
It is also important to take into account that any employer is considered a personal data operator, therefore, for each employee, appropriate consent is required.
Requirements for consent to the processing of personal data have changed
From September 1, 2022, new rules apply to the consent form for the processing of personal data, for violation of which operators are liable.
Consent must be “specific, specific, informed, conscientious and unambiguous”.
The operator is not entitled to collect information if it does not relate to the specific purposes of its processing.
Separately, it should be noted that it is not allowed to receive excessive personal information, that is, not related to a specific operation: for example, when ordering shampoo in an online store, information about a citizen’s passport data will be redundant.
Innovations of September 2022 – what exactly should be in the consent to the processing of personal data
The consent form for the processing of personal data must contain the following information:
• FULL NAME. citizen, his address, as well as information about the identity document;
• If a citizen acts through a representative – information similar to paragraph 1, as well as details of a document confirming the authority of the person;
• Name/full name personal data operator;
• Purpose of personal data processing;
• List of data for which consent is provided;
• In the event that the processing is carried out on behalf of the operator – name / full name. and the address of the person concerned;
• Validity of consent to the processing of personal data, as well as the method of its withdrawal;
• Signature of the citizen who gave consent.
What are the types of consents, what types of data are given
The most important requirement for the document is the ability to identify the person who gave the consent, as well as establishing a list of information and purposes for which the consent was given.
There are several types of consents to the processing of personal data, which include:
• Consent in writing;
• Consent in a simple electronic form;
• Consent in qualified electronic form.
In addition to various types of consents, there are also several types of personal data themselves: general (full name, information about documents, address, etc.), biometric (information that characterizes the physiological and biological characteristics of a person, on the basis of which you can to establish his identity), special (information about the state of health, religion, political views, nationality, race, etc.).
In addition, from March 1, 2021, new rules for interacting with data that are publicly available will apply.
By publicly available data we mean personal data that is disclosed to an indefinite circle of persons (for example, published on the Internet).
Consent is also required for the processing of such data. Such consent must be made separately from other consents.
From September 1, 2021, Roskomnadzor imposes special requirements on the content of consent to the processing of publicly available personal data.
It is worth noting that if it is necessary to transfer the received data to third parties, the consent must expressly indicate this possibility.
In view of the fact that the wording of consent is only being developed, Roskomnadzor offers to use a service that allows the operator to prepare a template for the consent form for the processing of personal data authorized by the subject of personal data for distribution, taking into account the professional specifics of the operator’s activities.
Consent to the processing of publicly available personal data can be given in two ways:
1. Directly by the subject of personal data to the operator.
2. From March 1, 2022 – through the information system of Roskomnadzor in accordance with this order.
Features of consent to cross-border transfer of personal data
This type of transfer of data about citizens is a procedure in which information is transferred to the authorities of a foreign state, as well as to a foreign individual or legal entity.
The law establishes a number of requirements that such a transfer may only take place with consent; international treaty; execution of an agreement with the participation of a citizen; protection of the life and health of the citizen himself or other persons if it is impossible to obtain consent in writing.
In cases where a company operates on the Internet without having a physical presence in Russia, if its activities are directed to Russia, it must comply with the requirements of the law.
That is, it is possible to collect, process and store a database of personal data about Russian citizens only on servers located in the Russian Federation. If the site is located on a foreign hosting, and at the same time data on citizens of the Russian Federation are collected and processed, the domain may be included in the register of violators of the rights of data subjects. The registry is maintained by Roskomnadzor.
The main feature of this type of transfer is that, in addition to informing the citizen about the upcoming transfer, it is necessary to notify Roskomnadzor, as well as to ensure the protection of the personal data transfer channel.
What to do first
In order to strictly comply with legal requirements, the following can be recommended:
• place on your site an agreement on the processing of personal data, after reading which the user of the site can express his consent to the processing of personal data;
• Request only necessary data. For example, a simple e-mail newsletter subscription is unlikely to require passport data;
• provide individuals with information about what data about him is stored in databases, why the data received from him is processed and to whom they are transferred;
• delete all information about the user after receiving the appropriate request;
• store personal data in a place that excludes access by third parties;
• develop a regulation on the processing of personal data, which must be signed by employees;
• Register as a personal data operator with Roskomnadzor.