Error message

Deprecated function: The each() function is deprecated. This message will be suppressed on further calls in menu_set_active_trail() (line 2405 of /homepages/3/d274688683/htdocs/devdrupalseven/includes/

Autonomy and consent

Why do I need to know about autonomy and consent?

  • Autonomy is a core ethical value in medical and research ethics, it concerns the interests of individuals in determining what happens to them.  Consent to potential secondary uses of patient data is therefore important because it permits self-determination in respect of personal information.   Broadly speaking if consent exists for a proposed research use of patient data, then its use is ethical. 

  • However, you should be aware that consent is not always straightforward.  Valid consent must be informed and freely given by a competent person.   Yet it would be impossible to anticipate and describe every potential secondary use of data at its time of collection.  So, proceeding without consent may be justifiable if the data is anonymised and/or the relevant authorisation has been obtained.  This authorisation will depend on researchers demonstrating sufficient public interest in the research to outweigh autonomy (and confidentiality) concerns.


The concept of autonomy essentially invokes the integrity and dignity of the human person. In the context of research involving the secondary use of patient data, the principles of autonomy means that individual should be able to decide what is to be done with his or her personal data. Respecting autonomy in this context therefore means that before use is made of a patient’s personal data, specific consent for the proposed secondary use should be obtained.

However, autonomy is not absolute as both ethically and legally it can be overridden by competing claims, such as paternalism or the public interest. In the context of using data for research purposes, it is competing claims of public interest that we are most concerned with. For more information on this use the menu on the left hand side to access the information page on ‘public interest.’


Consent is normally required if confidential data is to be disclosed. The function of consent in this context is to enable individuals to decide what his or her personal information is used for.

Explicit or implied consent?

Explicit consent is where an individual actively agrees, either orally or in writing, to the particular use or disclosure of information specified. The General Medical Council (GMC) recommends in their Confidentiality Guidance that, in the anbsence of some other legal jutification, express consent should be sought from patients to use their personal data, as this will leave no room for doubt as to what has been agreed. However, while express consent may be preferable, in the context of medical research it is not always possible, or indeed necessary, to obtain express consent.

Implied consent is where an individual signals their consent through their behaviour. It is not a lesser form of consent than implied consent, but is only valid if the patient genuinely knows what they are consenting to. However, this can often be difficult to show in the context of disclosures of information.

When is consent legally valid?

Essentially it doesn’t matter whether consent is given explicitly or impliedly, so long as it is legally valid. In order for consent to be valid it must be given by someone who is legally competent, it must be given voluntarily and it must be informed.


In law adults are presumed to be legally competent unless there is evidence to suggest otherwise. The common law test for competence was developed in the case of Re C in 1994 which provided that it must be shown that (1) the individual understands and retains information about the proposed treatment/research; (2) the individual believes that information, and (3) the individual has the ability to weigh the information in the balance so as to arrive at a decision.

However, legislation does provide that in some instances it is lawful to involve adults who lack capacity in research, so long as the research is related to a condition from which they are suffering and that the research has been approved by a Research Ethics Committee. For more information see the Adults with Incapacity (Scotland) Act 2000, part 5 (Scotland) and the Mental Capacity Act 2005, s30 (England and Wales).

Minors can consent to allow their personal data to be used for research purposes if they are deemed to be ‘competent.’ Under the common law a child is ‘competent’ if they have sufficient understanding and intelligence to understand fully what is proposed. However, even if a child is deemed to be legally competent, it is still advisable to seek parental consent.


Consent must be given voluntarily, and therefore the individual must not have been subject to undue influence or coercion.


For consent to be valid it must be informed, meaning that the individual should be fully informed as to what they are consenting to, i.e. as to what their personal identifiable information will be used for. According to guidance given by the British Medical Association in their Consent Toolkit patients should therefore be given information about the nature, purpose and scope of the proposed research project and information about confidentiality. Patients should also be made aware that they can withdraw their information from the research project at any time.

It should however be noted that the standards for information disclosure about the proposed data use will vary according to the sensitivity of the data. The more sensitive the data, the more information will need to be given to the patient to ensure that consent is fully informed.

When does consent need to be obtained for the secondary use of patient data?

While it is always best to obtain consent whenever this is reasonably practicable, legally consent is not always necessary. Indeed, consent is only one of the mechanisms under the Data Protection Act 1998 which enables access to personal data. Therefore if one of the other conditions in schedule 2 (and possibly also schedule 3) of the Act can be satisfied, the need for consent can be dispensed with.

When deciding whether it is practicable to obtain consent, you should take account of:

  • The number of records involved
  • The age and likely traceability of patients
  • The possibility of introducing bias because of a law response rate
  • The cost of obtaining consent

Under the SHIP model, if it is not practicable to obtain consent, then it might be possible to still access the data either by anonymising it, or by seeking authorisation from the relevant authorising body. In order to obtain such authorisation you will need to demonstrate that the public interest in your research outweighs the implications of the interference with confidentiality that the information disclosure will necessarily mean, that the use of person identifiable information is necessary, and that it is not possible to obtain consent for the use of the information. 

 Autonomy or Consent

Once you have submitted a data access application through SHIP, the SHIP Safe Haven indexing service can facilitate the approproate level of anonymisation and the SHIP research co-ordinator will ensure that the correct authorisation is obtained for your data use. Please see the route-map on 'making an application to access data through SHIP' for more information.

SHIP Guiding Principles and Best Practice

SHIP Guiding Principles and Best Practices reflect the values which underpin the SHIP project. They are designed to act as a guide for all those involved in SHIP and data sharing. You as a researcher or data custodian should be aware of these guiding principles and best practices as they provide useful guidance as to the standards of information governance promoted and expected by SHIP.

  • Personal data must not be used without consent unless absolutely necessary.
  • Where possible and practicable, consent should be obtained from each data subject prior to the use and sharing of personal data for research purposes.
  • The refusal of data subjects must be respected unconditionally.
  • Where possible and practicable, individuals collecting data should adequately inform data subjects of all material issues relating to the storage and use of their data. Material issues are those likely to affect a person in a non-trivial way.
  • Where personal data are used, the minimum amount of personal data should be used to achieve the stated objective.
  • Where personal data are used, the reasons and justification for its use are adequate and clearly explained.
  • Where personal data are used, every reasonable effort should be made to inform data subjects of the purposes of the use.
  • Where obtaining consent is not possible/practicable, then (a) anonymisation of data should occur as soon as is reasonably practicable and/or (b) authorisation from an appropriate oversight body/research ethics committee should be obtained.
Best Practice
  • Consent procedures should be designed to obtain free and meaningful consent, that is, data subjects must be given sufficient information to make a decision that reflects their genuine wishes, must be given the opportunity to ask questions and have these answered, and must not be subject to coercive measures.
  • Where there is the prospect of future use of data that is unknown at the time of consent, then data subjects should be informed of the broad purposes for which the data might be used. These purposes will delimit the appropriateness of any future use.
  • Where consent is not to be obtained, the reasons for this must be clearly articulated and adequately justified.
  • Vulnerable populations should be given adequate protections with respect to their needs.
  • Cultural/religious beliefs should be respected in the approaches that are employed to consent/refusal and data use. These should reflect the NHS obligations in relation to equality and diversity.
  • Privacy notices used to inform individuals about the processing of their data must be sufficiently specific to be meaningful and must adequately reflect the range of purposes for which the data will be used. Reasonable effort must be made to draw these to the attention of data subjects.

Return to top of page