One of my first tasks at IRRI is to develop a consent form we can use across our agricultural extension service tools that at a minimum will inform end-users, usually extension agents and farmers, that we’re collecting personally identifiable data, and their ability to opt-out of certain data collection questions, or any data collection at all.
Theoretically, this should be straight-forward. We can make a short document that is clear about what data is being collected, our intended use of the data now and in the future, how we’ll ensure that its reasonably safe while in our care, and under what conditions and with whom we’ll share the data.
Theory gets complicated by an education vs. efficiency trade-off really quickly when over 200,000 people of varying digital literacy are using your tool already. Questions like these matter when you’re piloting at scale:
- What are the laws on user data collection in the 17 countries in which we work?
- What do extension agents and farmers really understand about their digital data?
- How much can we teach them about their rights and expectations in a consent notice?
Let’s say we can make concise consent form 300 words long, which itself would be an amazing accomplishment. That’s still several pages of scrolling on a mobile phone and at least a 5-minute discussion between the farmer and extension agent if the extension agent reads the full consent form to the farmer. (In our usual use case, extension agents work with the farmer and our tools to generate a recommendation.)
Quickly, I start to wonder:
- Where is the motivation for the extension agent to care, vs. click through without farmer consent?
- How much training will the extension agent need to explain the consent form correctly?
- What level of specificity will inform the farmer but not confuse them with foreign-sounding terms?
And that’s just the consent form itself, not what the larger concept of “consent” means, especially in a government-run program. At IRRI, we have data safeguards and protocols in place to protect user data, and we generally trust our team members to follow them. Not all of our partner organizations and governments have the same level of data privacy standards.
That opens up a whole other layer of questions:
- Can we just demand the extension agents and farmer trust us since this is a government-run program?
- Should we require partner organizations and governments have the same privacy standards as we do?
- Can someone demand to be forgotten if they want to opt-out at a later date?
- Since its truly a government system, at what point do we have to let them decide their own standards, even if they’re not what we’d want?
Speaking of consent standards, lest we get too paternalistic in our role as technology savants, when was the last time you read a consent form in full – be it offline at a doctor’s office or online when subscribing to a new service? And once reading the form, when, if ever, have you rejected it?
I bet never, which makes me wonder: do we need an informed consent form at all?
Where Are the Good Consent Forms?
Assuming that we really do need to put effort into consent forms, have you seen any that you liked? Have you written one yourself? Please share your examples in the comments! I’d love your thoughts, guidance, and examples ASAP. Thanks.
On consent forms, I’d rather have it and don’t need it than need it and don’t have it. Always protect yourself and organization from libel.
Not sure consent forms protect against libel, which is publishing false statements that damage a person’s reputation, vs. opening one’s organization to lawsuits under that country’s data protection laws.
For example, here in the Philippines, we have to have consent forms per the Data Privacy Act of 2012.
To quote form one analysis:
“It is fair to say that the [Act] imposes a fairly rigorous standard of data protection regulation, borrowing concepts from the recent overhaul of European data protection law and from South Korea, the Asia-Pacific region’s high-water mark.
Examples of European inspired developments include a right to object to profiling, a right of data portability and a mandatory 72 hour data breach notification requirement. As is the case under South Korean data protection law, data sharing requires that data subjects be notified of the specific identity of data transferees when they consent to data sharing arrangements.”
Hi Wayan,
Welcome to the CG! A couple of links that may be of interest for how ILRI approaches informed consent below – hope this helps.
Best wishes,
Iddo
https://clippings.ilri.org/2016/05/19/on-more-rigorous-informed-consent-in-one-health-cross-cultural-livestock-research/
https://news.ilri.org/2014/10/09/nformed-consent/
Wow, that’s an interesting study. I think the cartoon-based consent form is really nice design with the user thinking, and the refusal to sign, but more openness to verbal confirmation is surprising – especially since all who refused were literate.
Maybe they know better than others the power of a signature?
One example:
“My name is [NAME] and I work for a research program, called [PROGRAM/PROJECT’S NAME], which aims to alleviate hunger and poverty by increasing agricultural productivity. Your household is one of the over [NUMBER] households in [DISTRICT NAME] district in [COUNTRY NAME] selected to be interviewed now and at the end of the program (after [NUMBER] years).
Data collected from study households like yours will be used to determine and understand major constraints and opportunities for improving livelihood. Analysis of baseline and follow-up data will allow the research team to assess the effect of the Program on the livelihood of beneficiary farmers and help identify successful agricultural technologies and practices. Data to be collected from you will be coded and will be kept strictly confidential. All household identifying information will be held in strict confidence and used only for research purposes. No identifying information (e.g., respondent name) will appear in data report.
Participation in this interview is voluntary and you may refuse to participate, discontinue the interview at any time, or skip any question you do not want to answer with no penalty or loss of benefits to which you are otherwise entitled. You are allowed to ask questions concerning the research, both before agreeing to participate in the interview, during, and after the interview.
As head of the household or spouse of the head, I would like to ask you questions mainly about agricultural activities and consumption. I will need to ask also other household members about health status and labor, as well as measure weight and height of all women of reproductive age and children under 5 years old. Answering these questions is expected to take around 2 hours. You may find some of the questions (for example about household asset ownership and consumption of food and non-food items) sensitive and you can refuse to answer any sensitive question without any consequence whatsoever.
Please contact [NAME OF DATA CUSTODIAN/COLLECTOR] at [PHONE NUMBER] if you have questions about the research and your right as a research participant and [NAME OF PRINCIPAL INVESTIGATOR AUTHORIZED BY THE INTERNAL REVIEW BOARD] at [E-MAIL] if you face injury as a result of your participation in this survey. Please contact [NAME], the chair of the [INSTITUTION NAME Institutional Review Board] at [PHONE NUMBER] or [E-MAIL] if you need more information or have questions about this study.
Before I start, do you have any questions or is there anything I have said on which you would like further clarification? May I proceed with interviewing you and other household members?”
I think a good consent form allows the participants to “opt-in” rather than “opt-out” so organizations doesn’t automatically get consent when a participant doesn’t opt-out.
We (TEGA) have designed a brand new digital consent process to ensure respondents with low literacy fully comprehend what they are consenting to. We refer to this as ‘Engaged Consent’.
Engaged Consent comprises 4 steps and is implemented by the mobile device TEGAs use to conduct their research:
Step 1) An audio file verbalises the required consent using simple and clear language via the TEGA device.
Step 2) The respondent is presented with a multiple choice question with various answer options of consent types. The respondent / guardian demonstrates their comprehension of the consent by selecting the corresponding option. The interview can only progress when the correct consent type has been selected.
Step 3) We capture respondent / guardian consent via an audio recording which is instantly uploaded and stored on the TEGA Content Hub.
Step 4) Post interview, the respondent is asked again, based on the information they have revealed, if they are still happy to consent.
This approach maximises propensity of consent comprehension on the part of the respondent. The approach also eliminates the unreliable consent paper trails of previous methodologies.
Yes it absolutely matters, and yes it’s absolutely complicated and difficult in the ‘digital age’ and we need to think it through in more depth and consider the tradeoffs.
Some thoughts here from last year’s MERL Tech. http://www.ictworks.org/2016/11/07/rethinking-informed-consent-in-digital-development/
HHI has also written on the idea of “duty of care” when it comes to data. (e.g., it’s similar to ‘do no harm’ but you would need to prove you were not being grossly negligent) https://signalcodeorg.files.wordpress.com/2017/01/signalcode_final7.pdf
For Girl Effect, we’ve done simple Terms & Conditions for use of a mobile site that wiped out the legalese. There are examples of how this can be done in shorter and simpler ways. I will try to find a link.
Page 10 of this document took Instagram’s T&Cs and simplified them into one page. Still long-ish but better than the original and it gives some rights to the user. http://www.childrenscommissioner.gov.uk/sites/default/files/publications/Growing%20Up%20Digital%20Taskforce%20Report%20January%202017_0.pdf
Oxfam is experimenting with playing audio consent. Amy O’Donnell can tell you more.
There is a lot of discussion on informed consent and I don’t believe that it’s OK to assume poor people don’t care about it. At the same time it’s pretty impossible to have truly active and informed consent if you are going to open or share data without planning it out from the start. So the full Responsible Data cycle matters. More information here https://responsibledata.io/resources/handbook/
Just because you are not collecting data sensitive health data doesn’t mean that people don’t have a right to privacy and to consent. Financial data is extremely sensitive, as is agricultural data in some cases. And I wouldn’t put my trust in the hands of the government, especially in places with difficult governments who are actively discriminating against certain populations. You can try to use this as a “teachable moment” and become an advocate for data privacy and informed consent and the rights of the individual if you are working with partners.
We absolutely need to do better, but I don’t think eliminating informed consent efforts and assuming that poor people don’t care is the way to go.
Also, there is a website where you can find legal frameworks for most countries https://www.dlapiperdataprotection.com/
Could you share the Girl Effect one, even if its copy/pasting of text into a comment?
Not sure, if my experience can help but you can have a look on the following publications;
1): aman, T., Winschiers-Theophilus, H., George, F., Wee, A. Y., Falak, H., & Goagoses, N. (2016). Using sketches to communicate interaction protocols of an indigenous community. Paper presented at the Proceedings of the 14th Participatory Design Conference: Short Papers, Interactive Exhibitions, Workshops-Volume 2.(http://dl.acm.org/citation.cfm?id=2948088)
2): Zaman, T., Winschier-Theophilus, H.& Yeo. A.W. (2015) Reducing “white elephant” ICT4D projects: A Community-Researcher Engagement, Seventh International Conference on Communities and Technologies (C&T 2015), Limerick Ireland (http://dl.acm.org/citation.cfm?id=2768554)
3): Report Civic Technology and Digital Storytelling
in Northeast and Central Illinois (https://www.ideals.illinois.edu/handle/2142/91526)
For photographs that we collect with people’s stories, my team uses a pretty short and hopefully easy to understand form. We limit how their photo will be used and also provide them a copy of the final product. Here’s a genericized version of the text:
—-
I hereby provide my permission to [project name] to use my photograph and story in public reports and/or in web posts where it could potentially be seen by people inside and outside of [country]. Once it is made public, I understand that [organization name] will share a copy of it with me for my reference.
I understand that [organization name] will only use my photograph and story in association with [project name] publications, and that my photograph will not be explicitly shared by [organization name] for use for any other purpose. Since my photograph and story will be made available publicly online, I understand that [organization name] cannot fully control how others will share or make use of its contents. I also state that this interview is not being enforced on me in any form and all information provided / shared during the interview are true and authentic to my best knowledge.
Wayan, I think you bring up a really important question regarding informed consent. The form itself, if its understood, implies a value chain and surrounding governance, which as you point out, may or may not be there.
This is perhaps different from our consent forms in digitally powered societies for filling out an app or medical release. In many countries like the US, right or wrongly, most assume the quality of the surrounding governance and institutions makes our choice less important.
This is all the more problematic when we consider the extended life of datasets these days. Do you as the enumerator, or even project manager designing the survey, really know who will use this information moving forward and for what purpose? The chances of answering that question definitively is dropping in most cases.
Noel, check out the consent form that Josh published above. He tries to counter the exact issue you worry about – project managers not knowing where a photo could go – with a clear constraint in the consent form.
Of course that supposes that staff will follow that constraint.