Participant information and consent refer, in usability studies, to the notice of who processes personal data and why (Art. 13 GDPR, the EU data protection law) and to the voluntary, revocable agreement to a processing (Art. 7 GDPR). Both document the data protection concept but do not replace it.
- Classification and scope
- Participant information: transparency under Art. 13 GDPR
- Consent: conditions under Art. 7 GDPR
- Separate declarations instead of a single signature
- What information and consent do not achieve
- Process from recruitment to deletion
- Designing for understanding by the user group
- Frequently asked questions (FAQ)
Classification and scope
In usability studies with medical devices, study teams process personal data: contact details from recruitment, observation notes, and often video and audio recordings. This requires transparency toward the participants and, depending on the legal basis, their consent. Both are part of organizing the study, but they are not the same thing.
The participant information tells the participants who processes their data and for what purpose. The consent under data protection law is the voluntary agreement to a specific processing. A third item is to be distinguished from both: the agreement to take part, that is, the consent to participate in the study itself. This agreement is not a consent within the meaning of the GDPR (General Data Protection Regulation, the EU data protection law; Regulation (EU) 2016/679) but an arrangement about the course of the study. In practice, all three declarations are often on one form. That is convenient but makes the review harder, which we address below.
This article is a professional classification, not legal advice. Which legal basis and which wording suit a specific study is clarified by the controller (the party that decides on the purposes and means of the processing) together with its data protection officer.
Participant information: transparency under Art. 13 GDPR
If personal data are collected from the data subject, the controller must provide certain information to the data subject at the time of collection (Art. 13 GDPR). This obligation applies regardless of whether the processing is based on consent. For usability studies, the required information can be translated as follows:
- name and contact details of the controller and, where applicable, of the data protection officer,
- purposes of the processing and legal basis, for example the evaluation of the study,
- recipients or categories of recipients, for example the client of the study,
- storage period or the criteria for it,
- rights of access, rectification, erasure, restriction, objection and data portability, the right to lodge a complaint with a supervisory authority and, in the case of consent, the right to withdraw it.
Under Art. 12(1) GDPR, the information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language. If the data subject already has the information, the obligation does not apply (Art. 13(4)). That recording in a study is among the purposes to be communicated is an inference from Art. 13(1)(c): anyone who films must say so and state the purpose.
Consent: conditions under Art. 7 GDPR
Art. 6(1)(a) GDPR names consent as one of several legal bases for processing. Art. 4(11) describes it as a freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action. Art. 7 attaches conditions to this:
- Proof: the controller must be able to demonstrate that consent was given (paragraph 1).
- Clear distinction: if consent is given in a declaration that also concerns other matters, it must be clearly distinguishable from them (paragraph 2).
- Withdrawal: consent can be withdrawn at any time, the withdrawal does not affect the processing carried out until then, the person must be informed of this beforehand, and withdrawing must be as easy as giving consent (paragraph 3).
- Voluntariness: in assessing this, utmost account must be taken of whether the performance of a contract is made conditional on consent that is not necessary for it (paragraph 4).
The recitals (the explanatory part of the regulation) make this more specific. Under Recital 32, silence, pre-ticked boxes or inactivity do not constitute consent. Under Recital 42, the person should at least know who the controller is and for which purposes the data are processed, and should be able to refuse or withdraw consent without suffering detriment.
Separate declarations instead of a single signature
Recital 43 describes consent as not freely given if separate consent cannot be given to different processing operations although this is appropriate in the individual case. For usability studies, a separate request is therefore advisable. This is a design recommendation derived from this requirement, not a rule with a fixed catalog:
- Agreement to take part: I take part in the study and know how it works.
- Consent to the recording: audio, video or screen are recorded and used for the analysis.
- Consent to passing the data on to the client, if recordings or personal analyses are passed on.
- Consent to further use, for example for training or presentations.
Anyone who wants to take part in the study but does not want to be filmed must have a genuine choice. Whether the study can be conducted without a recording is decided by the study team during planning, not at the moment of recruitment. A consent that concerns only processing that is not necessary for the study (such as further use) should not be a condition for participation and the honorarium. This follows from Art. 7(4) and Recital 43 and is to be understood as guidance.
What information and consent do not achieve
Participant information and consent document a data protection concept, they do not replace it. The controller must comply with the principles of Art. 5 GDPR and be able to demonstrate compliance (accountability, Art. 5(2)). These include purpose limitation, data minimization and storage limitation. A consent does not cure collecting data in advance without need, and information replaces neither a deletion concept nor access restrictions.
Consent is also not the only possible legal basis. Art. 6(1) GDPR also names, among others, the performance of a contract (point (b)) and legitimate interests (point (f)). Which basis applies is a legal assessment in the individual case. Depending on the choice, the information obligation under Art. 13 remains, while the obligations under Art. 7 apply only to consent.
If a withdrawal is declared, the processing carried out until then remains lawful (Art. 7(3)). Under Art. 17(1)(b), there is a right to erasure if the person withdraws consent and there is no other legal basis. What this means for data that have already been analyzed or passed on should be defined before the study and communicated to the participants.
The handling of health data (Art. 4(15) GDPR) requires particular care. Art. 9(1) prohibits their processing in principle, and Art. 9(2)(a) permits explicit consent as an exception. This can become relevant if participants are selected because of a medical condition and information about it is collected. Whether health data are present in an individual case is a question for legal review.
Process from recruitment to deletion
The obligations run through the entire course of the study. A sensible sequence is:
- Recruitment: data are already collected when contact details and screening answers are captured. The information therefore belongs before the appointment confirmation, not only in the study room. This is a practical recommendation based on the time of collection under Art. 13.
- Appointment confirmation: the participant receives the information in writing and can ask questions.
- Study day: the consents are requested and documented before the recording starts. The team answers follow-up questions and points out the right of withdrawal.
- Analysis: only the data for which the purpose was communicated are used.
- Passing on and reporting: recipients receive data in line with the information.
- Deletion: recordings and contact details are deleted after the communicated period or, if provided for, used further for the communicated purpose.
Documenting these steps helps with the proof under Art. 7(1) and belongs in the study records (see usability engineering file).
Designing for understanding by the user group
That information must be understandable is required by Art. 12(1) GDPR. From a human factors perspective, this is a design task like the instructions for use of a product: the text should fit the user group. The knowledge from the user profile can be used for this.
Health care professionals may know consent forms from everyday clinical practice, while laypeople are more likely to be unfamiliar with data protection terms and may need shorter sentences, explained technical terms and concrete examples. These are assumptions that can be checked in the individual case, for example in a pilot test with the user group. A short overview up front, a structure organized by the participants’ questions and a contact for follow-up questions make sense. The consents are to be ticked or signed separately and not embedded in running text.
The requirements apply to every type of study, whether formative usability evaluation or summative usability evaluation, and to every method, such as the think-aloud method. Anyone who recruits representative users therefore plans the information into the usability engineering process from the start.
The participant information tells participants who processes data and why (Art. 13 GDPR). The consent under data protection law is the voluntary, revocable agreement to a specific processing (Art. 6(1)(a), Art. 7 GDPR). The agreement to take part in the study is to be kept separate from it.
Both document the data protection concept of a study but do not replace it. Consent is only one of several possible legal bases, while the information obligation applies in every case.
Sensible measures are information before the appointment confirmation, separate declarations for recording, passing on and further use, a clear path for withdrawal, and a design that fits the user group. Professional classification, not legal advice.
Frequently asked questions (FAQ)
Does every usability study depend on consent?
Not necessarily. Under Art. 6(1) GDPR, consent is one of several legal bases, and the regulation also names, for example, the performance of a contract and legitimate interests. The information obligation under Art. 13 applies regardless. Which basis applies is a legal assessment in the individual case.
What is the difference between the agreement to take part and the consent?
The agreement to take part concerns participation in the study and how it works. The consent under the GDPR concerns a specific processing of personal data, for example the recording. This is a professional distinction in study practice, and it should be recognizably separate in the documents.
What happens if a participant withdraws consent?
The processing carried out until the withdrawal remains lawful. Withdrawing must be as easy as giving consent. If there is no other legal basis, there is a right to erasure under Art. 17(1)(b). How data that have already been analyzed are handled should be defined and communicated in advance.
May the honorarium be made conditional on consent?
Under Art. 7(4), in assessing voluntariness, utmost account must be taken of whether a contract depends on a consent that is not necessary. A consent to processing that is not necessary for the study should therefore not be a condition for participation or the honorarium. This is guidance, not legal advice.
Do participants with a medical condition need special protection?
Health data belong to the special categories of personal data. Under Art. 9(1) GDPR, their processing is prohibited in principle, with exceptions such as explicit consent under Art. 9(2)(a). Whether health data are present should be reviewed legally before the study.
Are you planning a usability study with medical devices? We support you with planning, recruitment and conduct, including understandable participant documents.
More about our usability engineering