To facilitate neuroimaging data sharing, a template data sharing consent form was generated by pooling forms from many places and being reviewed by ethic experts and lawyers, resulting in a 1st draft of open consent around 2015. This consent doesn’t however comply with the European General Data Protection Regulation (GDPR), and work has been done in June 2019 during OHBM Hackathon toward updating the consent: see this google doc. Following up on this work, the GliMR COST action joined the project and organized a workshop in November 2019 to create a new consent form.

Workshop Participants

surname name email expertise
Pernet Cyril neuroinformatics, data management
Katsaros Vasilis clinical
Mutsaerts Henk-Jan signal processing
Benedetta Pizzini Francesca clinical
Barker Gareth ethic, multi-centre trials
Heunis Stephan cognitive neuroscience, method, OBC
Herholz Peer cognitive neuroscience, method, OBC
Oostenveld Robert ethic, data management
Broeckx Nils law, GDPR

Issues addressed during the workshop


Following the OBC, data must be de-identified before distribution. However, it has become clear that one can single out subjects from biomedical data and/or MRI scans (including fMRI profiles from connectivity). This means that changes to the data (removing ID and defacing) is only a pseudo-anonymization procedure and according to GDPR, that procedure leaves the data as ‘personal’ (as opposed to ‘anonymized’).


There are specific items required in a consent form that needs to be updated: data controller, data processor, legal basis, right to withdraw, info and contact of the data protection officer, how data are pseudonymized, infrastructure where data are stored, where data are shared, how people will access data, signature of who collected the consent, where and when.

GDPR doesn’t allow sharing freely personal data outside the EEA –> a data user agreement must be used, limiting redistribution, excluding attempt to reidentify, and including what to do re-identification occurs.

Clinical Data

When collecting data from patients, there are some specifics aspects to consider that should be included (as a separated template?).



We streamed the morning session on google hangout.

  • 10.00 Sharing brain MRI data under GDPR (Cyril Pernet)
  • 10.40 Introduction to the OBC (Stephan Heunis)
  • 11.15 Issuing a Data User Agreement - example from the Donders (Robert Oostenveld)
  • 12.00 Collecting and sharing Patients data (Francesca Benedetta Pizzini)
  • 12.30 General Discussion (Nils Broeckx, chairing/answering GDPR questions)
  • 13.30 Split per working groups to update the documentation
  • 16.00 Wrap-up

From there, discussion on GitHub followed to update all documentation.