Under TCPS 2, what is required for the secondary use of data?

• A. Data can be used for any purpose as long as de-identified.
• B. Obtain consent or use de-identified data; apply governance, privacy protections, and respect for future use.
• C. De-identified data are prohibited from re-identification.
• D. Consent is never required for secondary use.

Answer: (B)

The key idea is that using someone’s data for a purpose beyond the original study requires careful protection of privacy and clear parameters for future use. Under TCPS 2, you either obtain consent for the new use or you work with data that have been de-identified, but you must also have strong governance, privacy protections, and a clear stance on future uses.

Obtaining consent for the secondary use is straightforward: participants are informed about how their data will be used beyond the original project and agree to it. If consent isn’t feasible, de-identifying the data aims to reduce privacy risks, but that alone isn’t enough. You still need robust governance—policies, data access controls, and security measures—to oversee how the data are used and shared. You also have to respect participants’ preferences about future uses; the data steward should ensure any future research uses align with what participants would reasonably expect or with the consent terms and governance arrangements in place.

Why the other ideas don’t fit: claiming data can be used for any purpose simply because it’s de-identified ignores the necessary governance and privacy protections and the need to respect future use. De-identified data aren’t guaranteed to be free of re-identification risk, so safeguards remain essential. And saying consent is never required contradicts the standard options TCPS 2 recognizes—either consent for the new use or de-identification with appropriate governance.