Does Consent to Data Sharing Automatically Include AI Processing?

If Participants Agreed to Share Their Data, Can You Upload Those Data to ChatGPT?

You are conducting a qualitative study involving university instructors. The consent form explains that de-identified interview transcripts may be shared with authorized research collaborators for related educational research.

After completing data collection, you decide to use an external generative AI service to assist with organizing interview excerpts and identifying preliminary analytical categories.

You reason that participants already agreed to data sharing. If their information can be shared with other researchers, perhaps it can also be submitted to an AI provider.

However, the provider is not necessarily a research collaborator. It may process information under contractual conditions that differ from the arrangements governing academic data sharing.

Does permission to share research data automatically include permission to process those data through an external AI service, or must researchers evaluate the purpose, recipient, and conditions of the proposed processing separately?

Data Sharing Consent Does Not Automatically Authorize AI Processing

Why Research Data Sharing Permission Is Not Unlimited AI Processing Permission

What Does Consent to Data Sharing Usually Mean?

Research data sharing consent generally concerns permission to make specified information available to particular recipients or categories of recipients for defined purposes.

For example, participants may agree that appropriately de-identified interviews can be shared with authorized university researchers conducting related studies.

However, the meaning of the agreement depends on the actual consent language and applicable requirements.

Some arrangements permit controlled access to research datasets. Others allow public release of genuinely anonymous information, subject to relevant restrictions.

Researchers should not assume that the phrase "data sharing" establishes unrestricted permission for any organization to process the information for any purpose.

The permitted recipients, purposes, and safeguards must be examined together.

Distinguish Data Sharing From AI Processing

Data sharing and AI processing are related concepts, but they are not interchangeable.

For example, sharing a dataset with another university researcher may permit that researcher to conduct specified analyses under a data-sharing agreement.

Submitting the same dataset to an external AI service introduces a processing activity that may involve different contractual conditions, retention arrangements, or organizations.

However, AI processing does not necessarily involve a new independent recipient in every technical configuration. The provider's role must be established from the actual information flow and agreement.

Why the Recipient Matters

Participants may agree to share their information with certain organizations or types of recipients.

For example, consent may permit sharing with academic collaborators who are subject to institutional confidentiality requirements.

An external AI provider may operate under a different relationship, such as processing information on behalf of the research institution.

That distinction can matter legally and ethically, even when the provider is not using the information for independent research.

Researchers should determine whether the provider is acting as a processor, controller, recipient, or another relevant entity under the applicable framework.

The question of whether an AI provider becomes a recipient of research data should be answered using the actual service arrangement rather than the product's name alone.

When Might Existing Data Sharing Consent Cover AI Processing?

Existing consent and authorization may cover certain AI-assisted activities when they remain within the agreed purposes and processing conditions.

For example, a data-sharing agreement may permit authorized researchers to use approved computational tools to analyze information for a specified research purpose.

However, whether an external AI service falls within that arrangement depends on the agreement and applicable institutional requirements.

These examples illustrate possible outcomes rather than universal permissions.

Researchers should assess both the original sharing arrangement and the proposed AI processing activity.

Why a Research Collaborator Is Not Necessarily the Same as an AI Provider

A research collaborator may receive information to conduct specified research activities and may be subject to a formal data-sharing agreement.

An AI provider may instead supply computational infrastructure or processing services under a different contractual relationship.

For example, a collaborator may be authorized to examine de-identified interviews but not necessarily to submit them to an external chatbot.

The collaborator's authorization to access the data does not automatically establish permission to disclose them to another service.

However, an appropriately authorized processor may sometimes handle information on behalf of the institution without requiring the same consent arrangement as an independent research recipient.

The relevant obligations depend on the applicable legal framework and actual contractual conditions.

Does Sharing De-Identified Data Automatically Permit AI Use?

No. De-identification can reduce privacy risks, but it does not automatically remove every restriction on research data use.

For example, interview transcripts may omit names while retaining distinctive institutional roles or professional experiences that could identify participants.

Such information may remain personal data under applicable law.

Even genuinely anonymous datasets may be subject to licenses, data-sharing agreements, or ethical commitments restricting particular uses.

Researchers should distinguish reducing identifiability from establishing permission to use the data for a particular AI task.

The presence of de-identification measures does not, by itself, authorize an otherwise restricted processing arrangement.

Does Public Availability Mean Data Can Be Uploaded to Any AI Service?

Not necessarily. Public availability and unrestricted reuse are different considerations.

For example, a publicly accessible research dataset may have licensing conditions or terms governing redistribution and permitted uses.

Some public datasets may also contain personal information, particularly when the information was released under conditions that do not establish genuine anonymity.

Researchers should review the dataset's provenance, license, access terms, and applicable data-protection requirements.

Uploading public information to an AI service may constitute additional processing even when the original dataset is accessible online.

The researcher should not assume that public access eliminates all ethical or contractual obligations.

Does Consent to Data Sharing Include AI Model Training?

Not automatically. AI model training may involve a different processing purpose from using an existing model to analyze research information.

For example, a researcher may submit excerpts to a model to generate preliminary coding suggestions.

Another researcher may use the same excerpts as training data to develop a new model.

These activities may involve different retention conditions, future uses, and implications for participants.

Researchers should determine whether the original consent and data-sharing agreement authorize the proposed training activity.

A general statement permitting data sharing for future research should not be interpreted as unrestricted permission for model development.

Why Data Sharing Agreements Matter

Research datasets may be governed by agreements specifying permitted purposes, authorized users, confidentiality obligations, onward transfers, and security requirements.

For example, a university may receive a dataset under an agreement prohibiting disclosure to unapproved third parties.

Even if the researcher has legitimate access to the dataset, submitting it to an external AI provider may conflict with those conditions.

Researchers should examine whether the agreement permits the proposed processing and whether additional authorization is required.

They should not assume that an AI provider is automatically exempt from onward-transfer restrictions because it is described as a software tool.

Contractual permissions and participant consent should be evaluated separately where both apply.

What Does the GDPR Say About Data Sharing and Further Processing?

Under the European Union's General Data Protection Regulation, personal data processing requires an applicable lawful basis and compliance with relevant principles, including purpose limitation, transparency, and data minimization.

Article 5(1)(b) addresses purpose limitation, while Article 6(4) concerns assessment of compatibility for certain further processing activities.

Articles 13 and 14 establish information requirements concerning recipients or categories of recipients where applicable.

However, the GDPR does not establish that every use of AI requires separate consent.

Researchers should distinguish the scope of participant agreement from the lawful basis and conditions governing the particular processing activity.

Where another lawful basis applies, the analysis may differ from a situation in which consent is relied upon.

What Does the Philippine Data Privacy Act Require?

In the Philippines, Republic Act No. 10173 establishes principles of transparency, legitimate purpose, and proportionality for personal information processing.

The Act also establishes requirements and rights relevant to disclosure and processing of personal information, subject to its provisions and applicable exceptions.

For example, a Philippine university researcher may be authorized to share interview data with specified collaborators while still needing to evaluate whether an external AI service falls within the permitted processing arrangements.

The existence of data-sharing consent should not automatically be treated as a lawful basis for every additional processing activity.

Researchers should consult institutional ethics and data-protection personnel when the provider's role, purpose, or safeguards differ from the original arrangement.

Can a Data Sharing Agreement Authorize AI Without New Participant Consent?

Potentially, depending on the governing framework and original participant information.

For example, an institution may have an approved processing arrangement that permits authorized computational analysis for the research purpose originally described.

However, a data-sharing agreement between institutions cannot automatically override participant consent limitations or applicable data-protection obligations.

Researchers should evaluate whether both the contractual arrangement and the underlying research authorization permit the proposed AI activity.

Where new consent is not required, other safeguards and institutional approvals may still be necessary.

How Should Researchers Explain AI Processing in Data Sharing Materials?

Where AI involvement is material or required to be disclosed, the explanation should identify the processing purpose and relevant organizations without making unsupported assurances.

This wording is illustrative and does not independently authorize external AI processing.

Researchers should specify the actual data recipients, permitted purposes, and verified safeguards where required by the applicable framework.

How Can AI Help Review Data Sharing Permissions?

Generative AI may assist with comparing a proposed processing activity against the terms of a consent form or data-sharing agreement.

However, the model should not independently determine the legal meaning of an agreement or declare that the processing is authorized.

The researcher should verify the resulting assessment with the relevant institutional authorities before transferring protected information.

What If the Data Sharing Agreement Prohibits External Processing?

Researchers should follow the restrictions governing the dataset.

For example, an agreement may permit access by named research collaborators while prohibiting transfer to unapproved services.

In that situation, submitting the dataset to an external AI provider may violate the agreement even when the researcher intends to use the information only for the original research purpose.

The appropriate response may involve seeking an authorized amendment, using an approved local processing environment, or avoiding the proposed service.

Researchers should not assume that technical de-identification or the promise of human oversight overrides contractual restrictions.

What If Participants Originally Agreed to Broad Data Sharing?

Broad consent may support certain future research uses, but it does not necessarily authorize unrestricted onward processing.

For example, participants may agree that their interviews can be used for future educational research without explicitly permitting external AI model training.

Researchers should examine the defined research purposes and conditions rather than interpret broad wording as unlimited permission.

The related question of whether broad consent covers future AI analysis requires attention to the actual scope of the original agreement.

What If AI Processing Was Not Mentioned in the Original Consent?

The absence of an explicit AI reference does not automatically establish that every AI-assisted analysis is prohibited.

However, the researcher should examine whether the proposed processing materially differs from what participants were told.

For example, using an authorized analytical tool within existing institutional arrangements may raise different questions from transferring identifiable information to a new external provider.

Where the change is consequential, additional institutional review, participant information, or reconsent may be necessary.

Researchers should not implement processing requiring prior authorization while assuming that the original data-sharing agreement is sufficient.

When Should Researchers Decide Not to Use AI?

Sometimes the proposed AI processing cannot be reconciled with the conditions under which the data were shared.

For example, a dataset may contain identifiable information and be governed by an agreement prohibiting external processing.

If an appropriate alternative or additional authorization is unavailable, the researcher should not upload the data to the proposed AI service.

The appropriate decision may be not to use AI for that dataset rather than disregard the original restrictions.

Data sharing permission should be treated as a defined authorization, not a general invitation to use every available analytical technology.

Using a Shared Interview Dataset With an External AI Service

The example illustrates why permission to access research information does not automatically include permission to transfer it to an external AI service.

The researcher must respect both the participant-related conditions and the agreement governing subsequent use.

Common Misconceptions About Data Sharing Consent and AI

Check Both the Permission to Share and the Permission to Process

Before submitting shared research data to generative AI, examine the original consent, the agreement governing access to the dataset, and the proposed AI processing arrangement.

Determine whether the intended purpose, provider involvement, and information handling conditions are covered by existing authorization.

Document the relevant permissions and the institutional determination before transferring protected information.

The ability to access a research dataset does not automatically establish permission to submit it to another processing environment.

Before Using Shared Research Data With Generative AI

Frequently Asked Questions About Data Sharing Consent and AI Processing

Permission to Share Research Data Is Not Permission to Process Them Without Limits

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.