Broad consent: Clarifications and considerations for researchers and research ethics boards
Guidance to support the implementation of the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS)

Table of Contents

Part I: Context

1. Introduction

Broad consent is a term often used to mean consent for future unspecified research, where consent is obtained in accordance with Article 3.13 (as appropriate to the particular research project). It is widely used in the context of research data repositories and biobanks, most notably for health or biomedical research. However, it is also being adopted across other research domains. Seeking broad consent from participants is good practice, when determined to be ethically appropriate, and should be considered from the outset when researchers believe the data and/or human biological material (HBM) might be used for future research purposes. The concept of broad consent and the elements it captures were formally introduced into the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans – TCPS (2022) with the addition of Article 3.13 and its application.

The TCPS encourages the sharing and secondary use of research data and HBM beyond the original purpose for which they were collected. This practice avoids duplication in primary data collection and therefore reduces burdens on participants. It enables the corroboration or criticism of original findings, facilitates longitudinal analyses, allows for the application of new tests of hypotheses or methodologies that were not available at the time of original data collection, and supports the verification of the data or HBM’s authenticity (Chapter 5, Section D and Chapter 12, Section C). However, such sharing must be undertaken with careful attention to participant protection, ensuring that appropriate safeguards and governance mechanisms are in place to secure data and HBM during both storage and future use.

While definitions of repository may vary across disciplines, the interpretation provided in the TCPS is not intended to be exclusionary. The research data management landscape is rapidly evolving, with a growing emphasis on data sharing, stewardship, and infrastructure development. As this space evolves, a diversity of terminology has emerged, reflecting variations in disciplinary practices, institutional policies, and international standards for the storage and sharing of data for future research use.

Within the TCPS, repository is defined as “A data repository or biobank with a known governance framework that ‘must ensure safe storage, preservation and curation of the data’ and human biological materials” (see ). The term biobankFootnote 1, as defined in the TCPS, covers a wide range of situations: some are very small, while others hold HBM from thousands of individuals. These biobanks can be held by an individual or by institutions or organizations. Similarly, research data repositoriesFootnote 2 can have a wide range of possible characteristics, but the key characteristic is the intent to share data for specific or unspecified future research purposes. For example, a research data repository could include a dataset collected by an individual researcher and made available to others via a researcher-maintained portal, large collections managed by institutions or consortia, or infrastructure that holds many different types of data.

Despite these definitional differences, the underlying ethical principles – such as privacy, consent, and responsible stewardship/data governance – remain consistent and complementary. Researchers and research ethics boards (REBs) should be mindful of the definitional differences and ensure that terminology is interpreted in context, with attention to both ethical and operational considerations. Therefore, the general principles outlined in Article 3.13 apply to all research disciplines.

2. Purpose

This guidance is intended as an educational resource to support the interpretation of the TCPS and assist researchers and REBs in the ethics review of research proposing the use of broad consent. It complements the application of existing guidance in the TCPS on topics such as privacy and confidentiality. This guidance covers several interconnected topics: broad consent for the storage of data and HBM for future unspecified researchFootnote 3, the deposit of data and/or HBM into existing repositories (where appropriate), and questions related to participant protections, data management, and data sharing. It also clarifies REB responsibilities related to the creation of repositories.

This guidance integrates and replaces several public interpretations developed by the Panel on Research Ethics (PRE) on the topic.

As with other areas of guidance, TCPS sets out core principles and general guidelines. It is up to each institution to establish its own policies or procedures that implement those guidelines in a manner suited to its own context.

3. Scope

This guidance explores the following questions:

Although the application of broad consent (and this guidance document) is often thought to be most relevant to health and health-related research, notably large-scale population or health-related research data repositories or biobanks, it also applies in other disciplines, including but not limited to the humanities (e.g., cultural studies, linguistics, anthropology), social sciences (e.g., psychology, sociology, political science), or business (e.g., economics, consumer behaviour studies, customer satisfaction, organizational studies).

Note that provincial legislation may establish specific requirements governing the use of personal health information in research. As such, elements of this guidance document may be subject to variation or may not be universally applicable across or acceptable in all jurisdictions. The TCPS stipulates that “researchers are responsible for ascertaining and complying with all applicable legal and regulatory requirements with respect to consent and the protection of privacy of participants” (Chapter 1, Section C, Research Ethics and Law). Where a tension between the requirements of the law and the guidance of the ethical principles in the TCPS exists, researchers must comply with the law in the application of ethical principles.

Part II: Guidance

4. Broad consent definition and characteristics

a) What are the characteristics of broad consent?

The defining characteristic of broad consent is that consent is obtained for future research, in a manner appropriate to the anticipated scope of that research and consistent with the requirements set out in Article 3.13. Broad consent is not a waiver of consent, but an alternative to study-specific consent. For the purposes of TCPS, broad consent is defined as consent for future unspecified research (subject to applicable law) (Chapter 3, Section E). Broad consent always includes specific parameters and associated practices, as set out in Article 3.13 and applied as appropriate. When participants have consented to their data and/or HBM being used in future unspecified research (within specific parameters and associated practices), researchers are responsible for putting mechanisms in place to ensure that participants’ wishes, as expressed in the original consent, are respected and that the privacy and confidentiality of their data and/or HBM is protected, as specified in the terms of consent.

Article 3.13 “To seek broad consent for the storage and future unspecified use of data and human biological materials, researchers shall provide prospective participants, or authorized third parties, with applicable information as set out in Articles 3.2 and 12.2, as well as the following details, as appropriate to the particular research project

  1. the type, identifiability, and amount of data and human biological materials being collected and stored for re-use, and for what potential purpose;
  2. the voluntariness of the participant's consent, including any limitations on the feasibility of withdrawal;
  3. a general description of the nature and types of future research that may be conducted, including whether the research might be conducted outside of Canada (if known);
  4. the risks and potential benefits of storage of data and human biological materials, and of their use in future unspecified research, including areas of uncertainty where risks cannot be estimated;
  5. access to a general description of the repository and its governance;
  6. a statement regarding participants' preference to being re-contacted for additional future research;
  7. whether the data or human biological materials could be shared with researchers who are not subject to the TCPS;
  8. whether the research will (if known) or might include whole genome sequencing or similar technologies that may pose a substantial risk of re-identification of the participant or identification of material incidental findings (when appropriate);
  9. whether linkage of data gathered in the research or derived from human biological materials with other data about participants – either contained in public or personal records – is anticipated (Article 5.3); and
  10. separate options for consentingFootnote 4 to participate in a specific research project and for consenting to the storage of data and human biological materials for future unspecified research.”

Parameters: It is not possible to delineate or identify every type of research that may be conducted with the data and/or HBM in the future. Therefore, general descriptions or categories of the potential types of future research would be sufficient to allow a prospective participant to make an informed decision about whether they consent to the storage and future research use of their data and/or HBM. Examples of possible types of research may include research on a particular disease or class of diseases (cancer, cardiovascular diseases, chronic diseases); research related to public health; population genomics; or healthy aging. It could also include research looking at long-term social trends (family structures, migration patterns, employment changes), anthropological research on cultural practices, civic engagement trends over time, cultural and linguistic research (dialect studies, socio-cultural evolution). The important element to consider is that these general descriptions or categories reflect a larger set of possible uses. Any future use that falls outside the descriptions or categories communicated to prospective participants may require additional consent, as such uses would extend beyond the established scope of the broad consent.

REBs should avoid requesting overly granular details that could undermine the purpose and practical applicability of broad consent, which is to facilitate future research using data and HBM without requiring direct contact or intervention with participants at that time. Additional considerations may also exist for participants beyond the type of research that may be conducted. For example, concerns could include the types of organizations accessing the data and/or HBM or the context in which the research will be conducted.

Timing: Similar to consent for participation in a specific research project, broad consent is generally sought during the recruitment process and prior to the collection of data and/or HBM. In this way broad consent can be understood as consenting to a framework for future research use and avoids the need to re-contact participants at the time of the future research. Provided that future research uses of the data and/or HBM are consistent with the terms of the participants’ broad consent, researchers do not need to seek participants’ consent for the new research uses. However, REB review of the proposed future research would still be required in accordance with the TCPS (Articles 5.5A, 5.5B, 12.3A, 12.3B), following a proportionate approach to research ethics review.

Scope of consent: Subject to Articles 5.5A and 12.3A (including any additional legal or regulatory requirements), if the future research use is not within the scope of the original consent – including if it was silent on future use of data/HBM – participants would need to be re-contacted to seek their consent for the new future research use, if the data/HBM are identifiable (see Scenarios 3 and 6 for examples of reflections on this topic). If the data/HBM are non-identifiable, then REB review would suffice (Articles 5.5B and 12.3B). “Outside the scope” of the original consent implies use of data and/or HBM for purposes other than those outlined in the consent form. This determination is particularly important where the original consent was silent on future use of the data and/or HBM. The REB shall make the final determination on a case-by-case basis. If participants have declined the future use of their data/HBM, or if the original consent form explicitly stipulates that data/HBM will not be used beyond the specific research project, researchers must respect the participants’ decision. Researchers must not re-contact participants to seek additional consent and must not use their data/HBM for any future research purposes.

In some cases, re-contact may not be possible (e.g., where a participant may have moved or died, or when the research is complete), making ongoing consent impracticable, if not impossible. Researchers are encouraged to anticipate these situations during the study design phase and to incorporate relevant considerations into the consent process and documentation.

Therefore, when evaluating whether a broad consent approach is being appropriately applied, the focus should be whether the elements outlined in Article 3.13 have been adequately met. This assessment is not limited to the description of potential future uses (e.g., “all research related to human health”).

Communication: To build and maintain trust, accountability, transparency, reciprocity, and agency, the mechanisms for communicating with participants (including authorized third parties) should align with what was set out in the original consent. Researchers should also ensure that participants have access to information about the potential use of their data and/or HBM for future research purposes and are reminded of their participation and their right to withdraw (including any limits), where applicable. While ongoing communication with participants is considered good practice, its feasibility may vary depending on institutional capacity and available technological infrastructure, as well as the nature of the research. If material incidental findings are discovered in the course of future unspecified research under the terms of broad consent, more information and considerations are outlined in How to Address Material Incidental Findings – Guidance in Applying TCPS (2018) Article 3.4.

5. Review of research involving broad consent (data collection)

a) What elements should an REB consider when reviewing research proposals that involve broad consent?

REBs are responsible for reviewing the ethical acceptability of the broad consent process, including participant recruitment, the consent form and process, as well as overall alignment with the principles of the TCPS. This responsibility applies regardless of whether the data and HBM are newly collected, reused, or shared for future unspecified research. REB approval must be obtained before seeking broad consent from participants. The REB shall determine the appropriate submission requirements and process for the review of broad consent.

When reviewing the broad consent process, researchers and REBs are encouraged to draw from the list of elements outlined in Article 3.13. These elements can serve as a starting point for determining what information is appropriate for inclusion in a broad consent form (as appropriate to the research project).

Not all elements are required for all types of research. It is up to the REB to assess which elements listed in Article 3.13 – or additional elements – are necessary based on the specifics of the research project. For example, there may be circumstances in which the REB determines that it is ethically acceptable to waive the requirement for participants to provide separate consent for participation in a specific research project and for the storage of their data and/or HBM for future unspecified research. The expectation is that such exceptions would not be broadly applied, but remain discipline/domain-specific or limited to certain types of interventions. In these cases, the onus is on the researcher to justify to their REB that separate consent for future unspecified research use of the data and/or HBM is not feasible. The REB makes the final determination regarding the exception and may request additional justification from researchers. See TCPS Interpretations, Consent #8 for more information.

The REB’s assessment of which elements listed in Article 3.13 are necessary should follow a proportionate approach, considering the context and nature of the research under review (Chapter 1, Section C), which will determine the level of scrutiny and detail that will be required in the review. The REB should assess the nature of the data and/or HBM, the level of risk, the nature and types of future research, as well as what process and safeguards are in place to protect how participants’ data and/or HBM will be stored and used in the future.

Research involving First Nations, Inuit, and/or Métis communities: If broad consent is contemplated when conducting research with First Nations, Inuit, and/or Métis peoples, consistent with the principles of Chapter 9 , researchers shall seek engagement with the relevant community (Article 9.1 ) and discuss the proposed consent process from the outset as part of ongoing community engagement. Researchers seeking broad consent for future unspecified research, as with other research, have a responsibility to become informed about, and to respect, the relevant customs and codes of research practice that apply in the particular community or communities affected by their research (Article 9.8 ). This includes adhering to any applicable community data management requirements. Upholding these standards is important to maintain respectful, trusting, and transparent relationships and engagement between researchers and participants.

The intention to seek broad consent is an important part of the community engagement process and an essential inclusion in a research agreement (Article 9.11). Researchers should work closely with knowledgeable community members to develop a consent process that ensures that prospective participants have a clear understanding of how their data will be used and managed if broad consent is given. Inconsistencies between the TCPS and community requirements should be identified and addressed in advance of initiating the research, and if they arise during the conduct of the research (Article 9.8). Researchers and REBs are encouraged to draw on relevant guidance in Chapter 9 of TCPS.

As with other research involving First Nations, Inuit, and Metis peoples, considerations should also include the relevance and community benefit of the research (Article 9.13); the opportunity to participate in the interpretation and analysis of research findings (Article 9.17); and the return of research results to the community and individual participants.

While Chapter 9 is primarily intended to guide research involving First Nations, Inuit, and Métis peoples of Canada, its principles on respectful relationships, collaboration, and engagement between researchers and participants may also provide valuable guidance for research involving other distinct communities, where appropriate (Application of Article 2.11). As is required for First Nations, Inuit, and Métis communities, when proposing research with other distinct communities, researchers and REBs must consider cultural traditions, customs, and codes of practice, as well as community-specific risks and benefits to research participation (Chapter 9, Introduction, Preamble). REBs and researchers are encouraged to draw on relevant articles from Chapter 9 when they align with the context of the particular community involved in the research (Chapter 9, Introduction, Preamble).

Multi-jurisdictional research: Subject to the requirements outlined above and applicable legal requirements, in multi-jurisdictional research involving multiple REBs and/or institutions, REBs are strongly encouraged to streamline the research ethics review process where additional ethics reviews are unlikely to enhance participant protections. For research involving minimal risk, REBs are encouraged to adopt the single REB review model (Article 8.1). For further guidance, refer to Applying the Single REB Review Model for Multi-jurisdictional Minimal Risk Research.

b) What should a researcher do when a participant only consents to participate in specific research, but not to the storage of their data and/or HBM for future (specified or unspecified) research?

Seeking participants’ broad consent for the storage of their data and/or HBM for future unspecified research is good practice. Article 3.13(j) strongly encourages researchers to seek separate consents for a) participation in the initial specific research project and b) the subsequent storage of data and/or HBM for future unspecified research. In practice, this means providing an option to consent to each separately. This can be done, for example, through separate consent forms or separate sections in the same consent form.

Consent to participate in a specific research project extends to the storage of their data and/or HBM for a period of time following the completion of the project, as per the terms of the consent form. However, if the participant declines consent to the storage of their data and/or HBM for future unspecified research, their data and/or HBM must not be stored or placed in a repository for this purpose, subject to legal and regulatory allowances (see Scenario 1 for an example of reflections on this topic).

Where consent for the storage and future use of participant data and/or HBM was not included in the original consent, additional steps may be required for their use in future research (e.g., re-contacting them to seek their consent for this purpose). See the Guidance on Depositing Existing Data in Public Repositories for additional guidance on how to address such situations.

The consent provided for participation in a specific research project extends to situations where data are deposited and/or made available in connection with journal publications for the purpose of reproducibility, transparency, verification, or error detection. Researchers must clearly articulate this to participants in the original consent form. These activities are not considered future unspecified research, as described in Article 3.13 (see Scenario 2 for an example of reflections on this topic). Certain academic journals require researchers to deposit data in open access or subscription-based repositories that allow for secondary use. In such instances, it is necessary to obtain broad consent from participants to enable this type of data sharing and future use. The researcher may wish to seek guidance from research data management or related experts on potential mechanisms for disclosing the minimal amount of data required to achieve the specified purposes.

6. Creation of a repository

a) Are REBs required to review proposals that involve the creation of a repository to store data and/or HBM for future unspecified research?

Anyone collecting data and/or HBM with consent in order to store and/or deposit them in a repository for future research purposes is required to abide by the general principles of consent in Chapter 3, and more specifically Article 3.13. This means that all data and/or HBM should be collected with the appropriate REB approval prior to its deposit into the repository. See Section 5a of this guidance document and Scenario 7 for an example of reflections on this topic.

7. Accessing data and/or HBM stored in a repository

a) What is the REB’s role in reviewing research that involves the use of data that are already stored within an existing repository?

When researchers subject to the TCPS want to use existing data and/or HBM from a repository, their REBs are expected to review and approve the proposed research. When assessing the ethical acceptability of the research, it is appropriate for the REB to consider general information about the nature and purpose of the repository, as well as how the data and/or HBM were collected, including whether the data/HBM are being used in accordance with the original terms of consent. In doing so, the REB is responsible for understanding those terms and ensuring they are upheld by the researcher throughout the conduct of the research.

Access to the data and/or HBM should be sought by the researcher directly through the repository’s access mechanisms (see Section 8b of this guidance document for a couple examples). Note that many repositories will require REB approval to release the data and/or HBM. When the data/HBM for which access is requested are anonymous, REB review is not required, provided the process of data linkage or recording or dissemination of results does not generate identifiable information (Article 2.4). Additional details on access mechanisms are beyond the scope of this guidance document and the REB’s mandate.

8. Data management and data sharing

a) Should direct identifiers be removed from data and/or HBM that are stored for future unspecified research purposes?

Data and HBM can be stored in different forms – identifiable, aggregate, coded, anonymized, anonymous – which will influence the level of protection required. Aggregate, anonymized, and anonymous data can be made publicly available for future research purposes if the risk of identification is low. Unless the participant has consented to being identified, directly or indirectly identifiable data (i.e., not anonymous or anonymized) should always be protected when stored, deposited, and/or made available for future research purposes. For example, via adequate access control measures that prevent misuse while facilitating future research.

Note that the TCPS and this guidance document recognize that the extent to which direct identifiers are removed from data and/or HBM should be described as part of the consent process. Researchers should carefully assess the identifiability of the data and/or HBM they intend to store and ensure that any measures taken to remove direct identifiers are appropriate to their discipline’s standards. Researchers may be subject to applicable legal and regulatory requirements with respect to protection of privacy and consent for the collection, use, or disclosure of information about participants. Researchers may also be subject to professional and contractual obligations, as well as other institutional requirements. As noted earlier, where tension exists between the requirements of the law and the guidance of the ethical principles of TCPS, researchers should strive to comply with the law in the application of ethical principles (Chapter 1, Section C, Research Ethics and Law).

b) Are all tiers of data access compatible with the definition of broad consent?

Data access tiers are different levels of access granted to users based on the potential sensitivity of the data. They include various levels of controlled access as well as open access. The most appropriate level of control over access to data will vary depending on the nature and sensitivity of data being collected and stored (e.g., identifiable, coded, anonymized, anonymous, or aggregated), as well as the original terms of consent. The anticipated degree of control over access provides a good example of the type of information that should be provided to prospective participants about broad consent. The data governance mechanisms and safeguards in place should be proportionate to the level of risk involved (re-identification, privacy, harm) and assessed on a case-by-case basis based on the research project under review. The goal is not to impede access to data and/or HBM, but to ensure that the appropriate safeguards are in place to responsibly mitigate the risks of data sharing. Researchers are encouraged to seek guidance from relevant experts, including those with expertise in research data access, governance, and security on how to ensure that the access management systems of their proposed repository align with the terms of consent to which participants have agreed. The level of access to data and/or HBM should be clearly communicated to participants in the original broad consent form. Two examples of common access tiers are provided below.

Controlled access

Where data are potentially identifiable (e.g., coded individual-level data), a controlled access approach may be preferred, as the data can be sensitive or have a higher risk of re-identification. Under a controlled access approach, there is ongoing oversight of research, such that researchers seeking access to the data are generally required to submit an application for review and approval by a Data Access CommitteeFootnote 6 (committee or individual) and sign a data access agreement prior to gaining access to the data to ensure downstream use aligns with the terms of the original broad consent.

Open access

An open access approach may be considered for certain types of non-identifiable data (e.g., aggregated data, anonymous data, or anonymized individual-level data) where the risks to participants, including risks of re-identification, are generally low or very low. This excludes all identifiable data. Under an open access approach, additional considerations may include:

In so doing, an open access approach to data access respects the parameters of broad consent and enables access to data that is as open as possible, but as protected as necessary (see Scenario 5 for an example of reflections on this topic).

Human biological materials

As HBM are a limited resource and contain potentially identifiable or sensitive information, they require greater protections around reuse and sharing for future use (i.e., controlled access). For data derived from or associated with HBM the same considerations outlined above for other types of data would apply.

Data/HBM governance mechanisms, whether through open or controlled access, play a critical role in fostering participant trust by ensuring appropriate oversight of the data and HBM. While controlled access repositories typically include additional legal and enforcement safeguards, the potential for data misuse remains once access is granted. Conversely, open access repositories generally contain less sensitive data, making a proportionate approach to safeguards appropriate. Nonetheless, voluntary, informed consent and meaningful protections must still be in place to uphold ethical standards in open access contexts.

Part III: Practical application

The scenarios presented below illustrate a range of situations designed to highlight various aspects of the broad consent process. They offer practical applications and considerations for both researchers and REBs. These scenarios are hypothetical and are intended to be illustrative and serve as a starting point for reflection and discussion.

Scenario 1: Depositing data into an open access research data repository following the completion of a research project

An academic researcher is conducting public health research on the impact of environmental factors on respiratory health. The researcher collects surveys, medical records, and human biological materials (blood samples). At the outset, the researcher sought to obtain broad consent from participants, ensuring that they understand that their data could be used for future unspecified research related to respiratory health and that these may be deposited into an open access research data repository after the research concludes. As the research nears its conclusion, the researcher prepares to deposit the data into an open access research data repository. The data will be anonymized prior to depositing. However, some participants declined to provide broad consent for their data to be stored and used in this way.

a) The researcher wants to know if they can include data from these participants in the open access research data repository.

If the participant declines consent to the storage of their data for future unspecified research, then their data must not be stored or placed in a repository for this purpose, subject to legal and regulatory allowances. Researchers must respect participants’ wishes and not re-contact them to seek their consent for storage (see the Guidance on Depositing Existing Data in Public Repositories).

b) Before depositing the data into an open access research data repository, what issues should the researcher consider? What should REBs consider when reviewing research and a researcher’s plan to deposit data into such a repository?

Researchers should deposit only non-identifiable data (e.g., aggregated data, anonymous data, or anonymized individual-level data) in open access repositories, and they should ensure that the risks to participants, including risks of re-identification, are low or very low. It is important for REBs to be aware of the researcher’s plans to deposit data into open access repositories and for this information to be clearly reflected in the broad consent form.

Researchers and REBs must be mindful that future research proposing to use the deposited data may or may not be subject to ethics review if conducted in jurisdictions that are not subject to the TCPS (i.e., research in other countries or research conducted under the auspices of institutions or organizations that are not eligible to administer Agency funds). Participants must be informed of this possibility, which should be clearly articulated in the consent form. Researchers must also comply with all applicable legal and regulatory requirements with respect to protection of privacy and consent for the collection, use or disclosure of information about participants, which may vary by jurisdiction (Chapter 5, Introduction).

Scenario 2: Sharing data for the purpose of verification and error detection

A journal requires that a researcher deposit their full anonymized dataset into the journal’s repository for review by peer reviewers solely for the purpose of verification and error detection. The journal will otherwise keep the data strictly confidential and not make it available for future unspecified research. Following completion of the peer review process, the dataset will be deleted.

The researcher wants to know whether this use is permitted in the absence of broad consent for future unspecified use.

Yes. This would be permitted even if participants did not provide broad consent to having their data used for future unspecified research. Article 3.13 does not specifically apply in the context of depositing or sharing data for purposes of reproducibility/transparency, verification or error detection. These contexts do not imply that a new research project will be conducted using the shared data (i.e., not a situation of secondary use). Therefore, this reuse of the data would fall within the scope of the study-specific consent provided by participants at the outset of the research, and should be clearly articulated therein.

Certain academic journals require researchers to deposit data in open access or subscription-based repositories that allow for secondary use of data. In such instances, it is necessary to obtain broad consent from participants to enable this type of data sharing and future use. The researcher may wish to seek guidance from research data management or related experts on potential mechanisms for disclosing the minimal amount of data required to achieve the specified purposes.

REBs and researchers should work together to determine whether measures to restrict future unspecified research uses, in the specific context of the research, would be ethically acceptable.

Scenario 3: Re-contacting participants for the storage and/or deposit of their data and HBM for future unspecified research use

A longitudinal research project aims to understand how brain development in adolescence is influenced by various factors such as genetics, environment, and lifestyle. The project has been collecting brain imaging data, behavioural assessments, and genetic materials from children over several years. After the research began, the researcher decided to deposit the data collected over the course of the research in a newly developed repository so that it can be stored and shared with other researchers in the future. The data would remain identifiable. This was not originally planned, and there was no mention of data sharing or deposit in the original assent and consent forms. Therefore, participants have not consented to the storage and/or deposit of their data future unspecified use.

The researcher wants to know if they need to re-contact participants to seek broad consent and whether REB approval is required to do so.

Yes, the researcher must re-contact participants (children) and their parents, guardians, or authorized third parties to seek broad consent from parents and assent from children for the use of their data in future research (specified and unspecified) (Articles 3.1, 3.2, 3.3, and 3.13), as data sharing or deposit for future research use was not addressed during the original consent process. This requirement applies unless participants previously indicated that they did not want to be re-contacted, in which case their data must not be shared or deposited in a repository for future research purposes. Since this research involves children, ensuring that appropriate mechanisms to maintain informed and ongoing consent are in place is an important consideration in the context of evolving capacity (Article 3.3). This should include seeking children’s autonomous consent once they have gained capacity to decide on their own behalf (subject to legal requirements in certain provinces). REB review and approval of the ethical considerations related to privacy, confidentiality, data management, and future research use will be required (see Sections 6a and 6b of this guidance document).

The researcher should communicate with their REB where there is uncertainty, or where participants have asked not to be re-contacted (i.e., not feasible to re-contact). Examples for the REB to consider include, but are not limited to:

In cases where broad consent was not sought from the outset, or where seeking consent/re-contact is impracticable, data may be deposited subject to REB approval and in accordance with Articles 5.5A and 12.3A. However, this approach should not be treated as the default. Researchers should incorporate broad consent considerations at the outset of their research design. In the context of longitudinal research, there is typically a continuing consent process, and thus regular communication or interaction with participants, so the researcher can use this opportunity to seek their broad consent. REBs are encouraged to prompt researchers to address broad consent during the initial ethics review of the proposed research. When in doubt, researchers should consult their REBs.

Scenario 4: Seeking broad consent for the storage of data on cultural practices for future unspecified research

A researcher, with the collaboration of members from a cultural community, is planning to study some rituals in the community and will collect ethnographic data such as observations, interviews, and photographs as part of the research project. Following the completion of the research, they would like to store the data and possibly make it available to other researchers doing similar research on cultural practices.

Should the researcher seek broad consent in this context?

Yes. If the researcher and their community partners believe the data might be used for future research purposes, seeking broad consent from participants at the outset is good practice. Depending on the sensitivity of the data collected, the researcher, in conjunction with the community, should determine the most appropriate level of data access and control required when deposited into a research data repository. This should be clearly communicated to participants as part of the consent process. The determination of the most appropriate level of data access and control should inform the level of scrutiny applied by the REB, and a proportionate approach to ethics review is encouraged – taking into account the context of the research and the foreseeable risks to participants (Article 6.12). Researchers are encouraged to engage with their REBs throughout this process.

Participants may provide broad consent to allow observations and photographs of cultural practices and transcripts of personal interviews to be used in future research on social structures, belief systems, or anthropological theory. This should be clearly mentioned in the consent form.

Where researchers intend to conduct research involving humans based on their membership in distinct communities, they should consider relevant guidance in Chapter 9, when appropriate (Article 2.11), as use of the data may have implications for the community involved (see also Section 5a of this guidance document). Researchers should also consider the various contexts (e.g., social, economic, cultural, spiritual) that may shape participants’ decisions to participate in research (Application of Article 3.13).

Scenario 5: Sharing personal health data and HBM for future unspecified research

A research team is conducting a long-term research project on aging and cognitive health. The team aims to track how lifestyle factors, genetics, and environmental influences affect cognitive decline in older adults. The researchers collect data from participants, using the following collection methods: cognitive assessments, questionnaires about their lifestyle and health, and biological materials such as blood or saliva.

In planning for the research, a researcher from the team conferred with prospective participants about the value in making their coded personal health data and HBM available not only for the current aging and cognitive health research, but also for any future studies on related topics such as Alzheimer's disease, Parkinson's disease, or even general public health initiatives. However, prospective participants were concerned about the level of sensitivity of the data and HBM, as well as the risk of re-identification.

How can the research team address these concerns while still enabling appropriate and feasible access to the data for other researchers?

Researchers should ensure transparency in the information that is provided regarding the measures in place to protect privacy and confidentiality, including the individuals or groups who will have access to the data and/or HBM and the purposes for which access will be granted. Access controls should be proportionate to the identifiability, sensitivity, and potential risks associated with the data and/or HBM. Researchers are encouraged to seek guidance from research data management or related experts where enhanced access control mechanisms may be appropriate.

As prospective participants are concerned that the data and HBM that will be collected, even though coded, would be considered potentially identifiable and sensitive (genetic data or health records), a controlled access approach to storing and sharing this information may be preferred. This approach enables ongoing oversight of both data and HBM, and typically requires review and approval by a Data Access Committee in response to a researcher’s request for access.

Another possible approach could be to adopt a combination of controlled and open access. This approach allows for flexibility in the sharing of data and HBM, enabling the implementation of varying levels of access based on sensitivity and intended use. For example, a controlled access approach may be applied to HBM, which are generally more sensitive, incorporating additional safeguards and oversight. Conversely, once data are appropriately anonymized, a more open access approach may be considered, as the risks to participants – including the risk of re-identification – are typically low or very low (see Section 8b of this document); thereby supporting access to data and HBM that is as open as possible, but as protected as necessary.

Note that other approaches outside of data tier controls are possible. Irrespective of the approach adopted, the key consideration is to ensure that information regarding data management and steps to mitigate re-identification are clearly communicated to participants during the consent process. Where there is doubt around the most appropriate approach, researchers should engage with their REB to make this determination based on the original consent, the identifiability or level of sensitivity of the data and/or HBM, and participant protections. The REB makes the final determination on the appropriateness of the approach, and the participant makes the final decision on whether they will provide consent.

Scenario 6: Anonymous data collection and sharing

A researcher conducts an online survey to study the sleep habits of university students and how it affects their academic performance. No directly identifying information is requested or collected (i.e., no names, email addresses, student ID numbers, or IP addresses) and there is no tracking of who completed the survey. The data is therefore anonymous as defined in Chapter 5, Section A, Types of Information. The researcher would now like to deposit the data in an open access research data repository to allow other researchers to conduct future research using the dataset. Consent was not sought for the storage and future use of the data.

The researcher would like to know if the data can be deposited in an open access research data repository and used for future unspecified research.

Yes. Where data are anonymous as defined in Chapter 5, Section A, the associated level of sensitivity, risk of re-identification, and privacy concerns are significantly lower than those associated with anonymized or coded data. In such cases, REB review for the secondary use of anonymous data is not required, unless data linkage, recording, or dissemination of results could generate identifiable information (Article 2.4).

When researchers intend to deposit data in a research data repository (open or controlled) for future research purposes, best practice requires that this intention be clearly communicated to prospective participants during the consent process. This includes describing the safeguards in place and any potential risks associated with depositing data into an open access repository. Providing this information enables prospective participants to make an informed decision about their participation, in accordance with the principles of the TCPS.

While in this scenario we are looking at anonymous data, in the context of anonymized data (both as defined in Chapter 5, Section A), researchers are encouraged to adhere to current best practices and guidance on anonymization for linked or anonymized data, ensuring that the data meet risk assessment standards where the risk of re-identification is very low.

Scenario 7: Collecting data for the purpose of populating a newly created national repository

A researcher wants to collect survey and interview data from individuals across Canada regarding their civic engagement activities (e.g., voting, volunteering, advocacy). Data collection will include online surveys capturing demographic information, political attitudes, and civic behaviours (e.g., public meeting attendance, voter preferences, volunteering for political parties), as well as optional follow-up interviews for qualitative insights. There is no research question at the time of collection – the data are solely being collected to support future research use. Data will be anonymized and stored in a national repository that the researcher plans to create to support future research on democratic participation, social cohesion, and public policy. The goal is to create a rich, longitudinal dataset that can be accessed and enriched by researchers studying civic engagement trends over time.

Is REB review required?

Although the creation of the repository itself does not require REB review and approval, REB review may be required for the activities involved in populating and using the repository. This distinction arises because the repository functions as infrastructure intended to support future research uses of the data – activities that fall outside the REB’s mandate. In contrast, the oversight and stewardship of the repository must be consistent with the terms under which broad consent is obtained, and these elements do fall within the REB’s mandate.

As the data are being collected to support future research, REB review and approval is required prior to initiating recruitment, broad consent, and data collection. At a minimum, the REB is responsible for reviewing the ethical acceptability of the broad consent process and ensuring that data collection, storage, and sharing comply with the TCPS.

Because REB review and approval will be required for the deposit or access to data and/or HBM, researchers are encouraged to consult with their REB early in the research and repository design process. Researchers from other institutions that are subject to the TCPS and wish to contribute to, enhance, or access the repository will also be required to obtain REB approval from their own institution.

For repositories involving multiple institutions (within or across provinces), the design process should contemplate streamlining ethics review, where possible (Articles 8.1 and 8.2). For further guidance, refer to Applying the Single REB Review Model for Multi-jurisdictional Minimal Risk Research.

Date modified: