According to the glossary of the Code of Conduct for Research Integrity, persons or groups are vulnerable if they cannot or are unable to express their will freely (limited autonomy) or if they are susceptible to damage due to their health, work, education or other characteristics.
Consideration of vulnerability is in line with the general principles of research ethics – particularly respecting human autonomy, not doing harm and doing good. The principles of fair processing of personal data (see 2.6) require, among other things, assessing the vulnerability: the data subject’s expectations must be taken into account, the exploitation and discrimination of the data subject is prohibited, and the purpose and method of processing must be ethical.
2.10.1. Vulnerable persons and groups
Children, the elderly, the pregnant, the unborn, prisoners and persons in custody, people with disabilities, ethnic minorities, the poor, the homeless, the illiterate, the unemployed and victims of violence are often considered vulnerable. The list is, of course, neither exhaustive nor universal.
Data protection does not distinguish between data subjects based on any additional characteristics; it gives everyone an equal and uniform right to the protection of their personal data. The GDPR only makes an exception for children, whose personal data protection is specifically emphasised. This does not mean, however, that vulnerability is irrelevant in data protection, especially when assessing the impact of data processing on individuals’ rights and freedoms (particularly in relation to discrimination) or the ethical nature of research.
2.10.2. Vulnerable person’s consent may not be voluntary
When vulnerability lies in a person’s limited ability to express their will freely, it is important to determine whether and to what extent this may affect the voluntariness of the person’s consent. The person’s ability to understand the information and the consequences of their decision must also be taken into consideration. Information is easier to understand when plain language or explanatory illustrations are used. Although there is no general obligation in Estonia to obtain the ethics committee’s approval when involving vulnerable people in a research study, it is good practice to do so to ensure better protection of their interests and rights. Ethics committee’s approval provides an additional guarantee that the vulnerability of the individuals has been adequately taken into account in the study.
2.10.3. Processing of vulnerable persons’ data may jeopardise their rights and interests
The processing of personal data may involve a higher-than-usual risk of discrimination or stigmatisation of vulnerable persons. This may require a data protection impact assessment, which should include a thorough evaluation of the possible consequences for the research subjects and propose additional measures to mitigate the risks (see also 2.14).