consent-management.rst

.. _consent:

Consent Management
==================

Review of the legal basis for data processing
---------------------------------------------

There are three options that justify **Legal basis for data processing**:

-   **Recruitment consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR)
-   **Study consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR and Art. 27 BDSG)
-   **Guardianship** (Art. 6 (1) lit. a, Art. 9 (2) lit. a DSGVO and Art.
    1626, 1902 BGB)

Castellum is mainly used for the management of **Recruitment consent**. **Study
consents** must be obtained separately from the database by the respective
**Study conductor** at the execution level

1.  Click on **Admin** on the front page

2.  Go to **Consent documents** in the **Subjects**-field

    -   There you will see a list of all consent documents that have already been
        created
    -   As additional information, the date of creation and the validity of the
        consent document are displayed

Updating consent forms
----------------------

Consent documents are marked as invalid if a change in the law occurs,
significant changes are made to the old document, or other reasons require the
subjects's signature on a new document

1.  There are two options that can be implemented when a consent document becomes
    invalid.

    -   For both options, first go to **Admin** at the front page > **Consent
        documents** > click on the creation date of the consent document to be
        modified

    1. The consent document can be marked as **Is valid** AND **Is deprecated**

        -   **Is deprecated** can be seen as a intermediate step in the process of
            declaring a valid consent document to be invalid
        -   If both checkboxes are marked, the subjects remain in the database
            and may be recruited. However, a new declaration of consent should be
            obtained as soon as possible

    2.  If only the box **Is deprecated** is ticked, the consent document is
        presumed to be invalid in general

        -   If the invalidity of the document is saved, there is no longer any
            recruitment consent of subjects in the database

    This does not apply if the **Legal basis for data processing** refers to a
    **Study consent** or a **Guardianship**.
    The **Legal basis for data processing** can be viewed for each individual
    subject by following the instructions below:

    -   Go to **Subjects** on the front page
    -   Enter the first and last name of the subject and click on **Submit**
    -   Go to **Details** next to the subject
    -   You can see three different **Legal basis for data processing** in
        **Overview** and which of those apply to the respective subject

2.  If you wish to upload a valid and current consent document, proceed as follows:

    -   Click on **Admin** on the front page
    -   Go to **Consent documents**
    -   Click on **Add Consent Document** (oval with grey background)
    -   Choose the file you want to upload
    -   Click on one of the saving options

Deletion of a consent document
------------------------------

1.  Click on **Admin** on the front page
2.  Go to **Consent documents**
3.  Choose the consent document to be deleted
4.  Click on **Delete**
5.  Confirm the query about whether the version should be deleted by clicking on
    **Yes, I am sure**

Maintenance of Recruitment consent
-----------------------------------

To get an overview of all subjects for whom a new **Recruitment consent** is
required, proceed as follows:

1.  Click on **Subjects** on the front page

2.  Go to **Maintenance** (blue button)

3.  Choose the fourth tab **Consent**

    -   You will see a list of all subjects with recruitment consents that are not
        current

4.  Click on **Details** next to the indication **Last updated on: XY**

    -   A new window will open for each subject with invalid recruitment consent

5.  Go to the fourth tab **Data protection** individually

    -   You will see an orange field that indicates the following text: **The
        subject has recently come of age. Please ask them to renew or withdraw
        their consent. This message will disappear once you change the value of the
        checkbox.**

6.  Obtain a valid recruitment consent either by E-Mail, telephone or post

    -   As an intermediate step, click once on the checkbox **Recruitment
        consent**. This is how you note that you are waiting for confirmation from
        the subject

7.  If the subject agrees or withdraws their consent in the current consent
    document, this must be indicated

    -   If the subject agrees, click on **Confirm** below **Recruitment consent**
        and **Save**
    -   If the subject requests a deletion according to GDPR, click on **To be
        deleted** and save your submission