Dictionary domainTrack D
Consent, privacy, and regulatory disclosure
GDPR/data-protection sections, the EU AI Act, informed-consent waivers, financial-interest and covered-species disclosure rules.
Terms in this domain
9 terms
Data Protection Act 2018, Section 19 (Research Safeguards)
DPA 2018 Section 19 was the UK domestic provision requiring that research/archiving/statistics processing under UK GDPR Article 89(1) not be likely to cause substantial damage or distress, and not be used for decisions about a particular individual unless for approved medical research. It was omitted from 5 February 2026 by the Data (Use and Access) Act 2025; the same safeguards now sit in UK GDPR Articles 84B and 84C.
EU AI Act Article 5 (Prohibited AI Practices)
Article 5 of Regulation (EU) 2024/1689 (the EU AI Act) lists AI practices that are banned outright across the EU, regardless of sector, risk classification, or intended purpose — including scientific research. A practice falls under Article 5 if it matches one of eight prohibited categories: (a) subliminal or purposefully manipulative/deceptive techniques that materially distort behaviour and cause significant harm; (b) exploitation of vulnerabilities tied to age, disability, or a specific social or economic situation; (c) social scoring by public or private actors leading to detrimental treatment in a context unrelated to the data that generated the score; (d) predictive policing based solely on profiling or personality-trait assessment, without objective, verifiable facts linked to a criminal activity; (e) untargeted scraping of facial images from the internet or CCTV footage to build or expand facial-recognition databases; (f) emotion inference in workplace or education settings, except for narrow medical or safety reasons; (g) biometric categorisation to infer race, political opinion, trade union membership, religion, sex life, or sexual orientation; and (h) real-time remote biometric identification in publicly accessible spaces for law enforcement, prohibited except for three narrowly defined purposes (searching for specific victims of trafficking or missing persons, preventing an imminent and specific terrorist threat, or locating a suspect in specific serious crimes carrying at least a 4-year custodial sentence), each requiring prior judicial or independent administrative authorisation. These provisions applied from 2 February 2025 — six months ahead of most of the rest of the Act — and unlike the Act's high-risk-system obligations, there is no proportionality test, self-assessment route, or conformity-assessment pathway around them: a matching practice is unlawful outright, and violations sit in the Act's highest penalty tier under Article 99 (administrative fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher).
Waiver of Informed Consent (45 CFR 46.116(f))
A waiver of informed consent under 45 CFR 46.116(f) is an IRB determination that a study may enroll subjects, or use their identifiable private information or identifiable biospecimens, without obtaining informed consent at all -- distinct from merely waiving the signed-form requirement under 46.117(c). An IRB (or, for research eligible for expedited review, an IRB chair or designated reviewer) may approve a full waiver or alteration of consent only after finding, and documenting in the study record, that all five criteria in 46.116(f)(3) are met: (i) the research involves no more than minimal risk to the subjects; (ii) the research could not practicably be carried out without the waiver or alteration; (iii) if the research uses identifiable private information or identifiable biospecimens, it could not practicably be carried out without using that information or those biospecimens in identifiable form; (iv) the waiver or alteration will not adversely affect the rights and welfare of the subjects; and (v) whenever appropriate, subjects or their legally authorized representatives will be provided with additional pertinent information after participation. This mechanism is the standard route for retrospective chart-review and secondary-database research, where re-contacting every prior patient to obtain prospective consent is often not feasible and would itself undermine the value or completeness of the dataset.
Translated Informed Consent Materials
Consent materials count as compliant "translated informed consent" when they make the required disclosure elements of 45 CFR 46.116 (and, for FDA-regulated research, 21 CFR 50.25) understandable to a prospective participant who does not read or speak English proficiently — satisfied through one of two IRB-approved pathways: (1) a fully translated long-form consent document, reviewed and approved by the IRB before use, or (2) the short-form written consent process under 45 CFR 46.117(b)(2) / 21 CFR 50.27(b)(2), in which a brief document in the participant's language states that the required elements were presented orally, backed by a bilingual witness and the English-language summary the person obtaining consent signs. Neither pathway is optional paperwork — both require prospective IRB approval, and neither can be improvised at the bedside or in the field without one.
Clinical Trial Transparency
Clinical trial transparency is the umbrella principle that every clinical trial's existence, design, and outcome should be made public regardless of what the results show. A given practice counts as advancing clinical trial transparency when it does at least one of three things: (1) makes a trial discoverable before it enrolls participants (prospective registration in a WHO-recognized registry such as ClinicalTrials.gov, ISRCTN, or EU CTIS), (2) makes that trial's summary results discoverable after it ends, including when results are negative, null, or unfavorable to the sponsor (results reporting, most concretely enforced in the US through FDAAA 801 and its implementing regulation, 42 CFR Part 11), or (3) makes the underlying protocol, statistical analysis plan, or individual participant-level data available for independent scrutiny (clinical data sharing). It is a movement and a set of overlapping obligations and voluntary commitments, not a single regulation -- a trial can satisfy one pillar (say, registration) while failing another (results reporting), which is precisely the gap transparency advocacy has spent over a decade trying to close.
MRC Guidance on GDPR and Confidentiality in Health Research
MRC GDPR and confidentiality guidance refers to the compliance framework the UK Medical Research Council (MRC), acting through UKRI and its MRC Regulatory Support Centre (RSC), sets out for researchers processing personal data -- especially health data -- in MRC-funded or MRC-affiliated research. It treats UK GDPR/Data Protection Act 2018 (DPA 2018) compliance and the separate common law duty of confidentiality as two distinct, cumulative obligations: satisfying one does not satisfy the other, and MRC-funded research is only compliant when both are addressed. Meeting the standard means (1) identifying a lawful basis for processing under UK GDPR Article 6 -- for MRC/UKRI research this is typically 'public task' or 'legitimate interests' rather than consent, since consent as a GDPR lawful basis carries withdrawal rights that are usually impractical for long-running research datasets -- (2) satisfying a separate condition for processing special category (e.g. health) data under UK GDPR Article 9(2) and DPA 2018 Schedule 1, and (3) independently respecting the common law duty of confidence owed to anyone whose confidential information -- most often identifiable NHS or health/social care data -- is accessed or shared, which GDPR compliance alone does not discharge.
Significant Financial Interest (SFI)
A Significant Financial Interest (SFI) is any financial interest an Investigator (or their spouse/dependent children) holds that meets the dollar or equity thresholds defined at 42 CFR 50.603 -- generally, remuneration exceeding $5,000 in the prior 12 months from a single publicly traded entity, or exceeding $5,000 or any equity at all from a single non-publicly traded entity -- subject to specific regulatory exclusions (e.g., the Investigator's own institutional salary, and compensation from U.S. government agencies or U.S. institutions of higher education for seminars/teaching/review-panel service). Meeting the SFI threshold triggers a disclosure obligation to the institution; it does not by itself mean a conflict of interest exists.
USDA Covered Species
The set of animal species that fall within the Animal Welfare Act's (AWA) statutory definition of "animal" under 9 CFR 1.1, and are therefore subject to USDA APHIS registration, inspection, and recordkeeping requirements. A species is "covered" if it is a live or dead dog, cat, non-human primate, guinea pig, hamster, rabbit, or other warm-blooded animal used or intended for use in research, teaching, testing, experimentation, or exhibition, or as a pet. Critically, the AWA's definition of "animal" explicitly excludes birds, rats of the genus Rattus , and mice of the genus Mus that are bred for use in research, as well as cold-blooded species (fish, amphibians, reptiles) and most farm animals used for food/fiber production research. Because purpose-bred rats, mice, and birds are the large majority of animals used in US biomedical research, most laboratory animals are, by this narrow legal definition, not "covered species" under the AWA -- even though the same animals are typically still covered under other frameworks (chiefly PHS Policy ) when the research is federally funded.
Confidentiality Advisory Group (CAG) / Section 251
The Confidentiality Advisory Group (CAG) is an independent advisory body in England and Wales that reviews applications from researchers and other organisations seeking to access or use confidential patient information without patient consent, and advises whether there is sufficient public interest to justify granting that access. CAG does not itself hold decision-making power: for research applications it advises the Health Research Authority (HRA), which makes the final decision; for non-research applications (for example, national disease registries or public health surveillance) it advises the Secretary of State for Health and Social Care, or in some cases NHS England. The legal basis CAG operates under is Section 251 of the NHS Act 2006 , which allows the common law duty of confidentiality to be set aside temporarily where anonymised or pseudonymised data cannot meet the research purpose and seeking individual consent is not practicable. Section 251 is given operational effect through the Health Service (Control of Patient Information) Regulations 2002 (the “COPI Regulations”) — specifically Regulation 5 (support for research and other purposes) and Regulation 3 (support for communicable disease surveillance and other public health risks). Approval obtained this way is commonly referred to as “Section 251 support,” “Regulation 5 support,” or a “CAG approval,” and the terms are used largely interchangeably in UK research-governance practice. CAG membership is drawn from a mix of clinicians, academics, and lay members, reflecting the requirement to weigh both the research/public-interest case and the patient-confidentiality interest.
