4Child - Four Counties Database of Cerebral Palsy, Vision Loss and Hearing Loss in Children

4Child Information and Privacy Notice

This notice is provided in compliance with the General Data Protection Regulation 2018. It relates to the use of personal data in the context of research conducted in the National Perinatal Epidemiology Unit and specifically the use of data by the 4Child database.

Contact details

If you have any questions about the information in this privacy notice please contact:

Name

Prof. Jenny Kurinczuk Jenny Kurinczuk

Role

Director, NPEU

Address

National Perinatal Epidemiology Unit (NPEU)
Nuffield Department of Population Health
University of Oxford
Old Road Campus
Oxford
OX3 7LF
OxfordOX3 7LF
OX3 7LF

Email

jenny.kurinczuk@npeu.ox.ac.uk

Tel

01865 289717

The University Data Protection Officer can be contacted via email: data.protection@admin.ox.ac.uk

The purposes of 4Child and how we use personal data

The 4Child database (originally called ORECI – the Oxford Register for Early Childhood Impairments) was established in 1984.

The aims of the database when it was established were to:

1. Monitor the prevalence of cerebral palsy, vision loss and hearing loss in children from 1984 onwards in the four counties of Berkshire, Buckinghamshire, Northamptonshire and Oxfordshire.
2. To provide a research platform and support research and service audit initiatives using data from 4Child, in order to contribute to knowledge and understand of the causes and consequences of the impairments and how they might be prevented and better managed.
3. To develop links with other researchers and collaborate in research within the UK, Europe and other centre around the world.

The 4Child database was run by the 4Child research team.

The operation of the 4Child database involved receiving information about children who were born or lived during in early childhood (up to age 5yrs) in one of the four counties, who were suspected and then diagnosed as having one of the three impairments: cerebral palsy, vision loss or hearing loss; of note some children have more than one of these impairments.

The information about the affected children was provided by any health professional who came into contact with the child during early childhood – so called multi-source notification. Multi-source notification is the mechanism used to ensure that no children were missed. We also received information from the Office for National Statistics about any children who died. This enabled us to carry out research into death rates for children with these impairments and to understand the reasons why some children and adults with these impairments die earlier than would normally be expected.

The information we received about the children was identifiable personal data and included the names, addresses and dates of birth of the children. Receiving identifiable information was necessary to enable us to identify when a child was notified to us more than once so that we could remove any duplicate notifications. The identifiable information also allowed us collect follow-up information about the children to obtain details about the extent and impact of their impairment. Using the information, with relevant regulatory permissions, we were able to contact some families to invite them to participate in research.

Funding was provided to support the work of 4Child from a number of sources over the years. Latterly it was funded by the Department of Health; this final grant ended in 2010. The 4Child research team was disbanded once the funding ran out. Jenny Kurinczuk is the only member of the research team who remains in the NPEU.

As it was not possible to obtain further funds the database closed to registrations of newly diagnosed children in 2010. Nevertheless, the existing database is an invaluable and unique source of whole population data about children with these three important impairments as currently there is no other similar information collected in England in this systematic way. Following closure of the database, for a while we continued to receive death certificate information from the Office for National Statistics relating to any children on the database who had died. We no longer receive new information from this source.

In view of the fact that was not possible to obtain further funding to continue the active work of the database a decision was recently made to remove all the identifiable personal information on the database and this process was completed in August 2019. This means that we have deleted all names, addresses, postcodes, dates of birth, dates of notification and diagnosis, where applicable dates of death, and all other date-related information held in the database. All relevant date information was replaced with age at the event. We have permission from NHS Digital to continue to hold the death certificate information relating to children who have died, which we have already received, for two years; we will not receive any further new information. The information we have includes the cause of death.

Despite removing the clear identifiers we will nevertheless hold information relating to individuals. Using the different pieces of information which we hold about individuals it would potentially be possible to combine these pieces of information together and identify an individual. Whilst we won't ever do that, this remains a possibility. Because of this the information that we hold is regarded as “personal data” under the General Data Protection Regulation.

Who is responsible for the data we collect?

Under the General Data Protection Regulation the 'data controller' is responsible for what happens to data which is collected. The 'data processor' is responsible for holding the data and processing it. The 'data controller' for 4Child is the University of Oxford. The NPEU is the 'data processor'. On a day to day basis Professor Jenny Kurinczuk is responsible for the 4Child data.

Lawful basis for processing the 4Child data

It is necessary to have a legal basis for holding and processing personal data. The legal basis for holding and processing the 4Child data is as follows:

General Data Protection Regulation:

• Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  There are no other population based sources of data about children with these impairments in England. 4Child provides a unique source of this information and thus it is in the public interest that we continue to hold the 4Child data.
• Article 6 (1) (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Common Law Duty of Confidence:

• We applied for and have received section 251 support under the 2006 NHS Act from the Confidentiality Advisory Group at the Health Research Authority to collect and process identifiable data about individuals without their consent for the purposes of the 4Child Database (PIAG 4-09 b)/2003).

How long we keep personal data for

The need to keep personal data in the long term depends upon the individual circumstances. For 4Child we have permission, under a data sharing agreement with NHS Digital, to keep the mortality data from the Office for National Statistics for two years. At the end of this period we will decide whether we have a continuing purpose for the mortality data which would justify keeping the information for longer. In the event a decision is made not to continue holding the data from death certificates, this information will be deleted from the database. At that stage we will also review the value of continuing to hold the rest of the data in the 4Child database.

How we protect data

We ensure that we protect all the personal data we hold, including the data held in the 4Child database, against unauthorised access, unlawful use, accidental loss, corruption or destruction. To do this we use 'technical measures' such as encryption and passwords to protect the individual databases as well as to protect the computers systems in which the databases are held. We also use 'operational measures' to protect the data, for example, by limiting the number of people who have access to the databases in which personal data is held.

We keep these security measures under review and refer to the University Security Policies to keep up to date with current best practice. Read the University Privacy Policy for research and The University Website policy

Sharing identifiable data

We will not share any data from 4Child unless the person requesting the data has the appropriate regulatory approvals and has a bona fide reason for needing to use the data. We will not onward share the mortality data from the Office for National Statistics without permission from NHS Digital. It is not be possible to share the personal data items we collected originally as these have been deleted from the 4Child database. Before sharing any de-identified data we will ensure that it is not possible, by combining separate pieces of information, to identify any individuals. We will do this by producing the data for sharing in a format which groups up information, for example age might be presented in 5 year age groups. We will not release any information from the 4Child database outside the European Economic Area (EEA).

The rights of individuals

We have removed all the personal identifier (name, address, date of birth, etc.) which would have allowed us to identify the information relating to a particular individual. As a consequence it will not be possible for individuals whose data are held to exercise their usual rights to contact us to access, change, delete or move their information.

Details of the existence of automated decision-making, including profiling

In relation to the 4Child data we do not make use of any method of automated decision-making or profiling of any sort.

Complaints

The individuals whose data we hold have the right to complain. If you believe you are one of the individuals whose information is held on the 4Child database and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, data.protection@admin.ox.ac.uk who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner's Office (ICO).

Contact us

If you would like to contact us directly for more information about 4Child, or how we use and protect data collected for research conducted at the NPEU more generally, please contact Professor Jenny Kurinczuk by mail, email or telephone at:

Name

Prof. Jenny Kurinczuk Jenny Kurinczuk

Role

Director, NPEU

Address

National Perinatal Epidemiology Unit (NPEU)
Nuffield Department of Population Health
University of Oxford
Old Road Campus
Oxford
OX3 7LF
OxfordOX3 7LF
OX3 7LF

Email

jenny.kurinczuk@npeu.ox.ac.uk

Tel

01865 289717