Privacy Notice


MBRRACE - PMRT Data flow

This notice is provided in compliance with the General Data Protection Regulation 2018. It relates to the use of personally identifiable information the context of research conducted in the National Perinatal Epidemiology Unit.

Background

'MBRRACE-UK' is the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn and Infant clinical Outcome Review Programme (MNI-CORP) which continues the national programme of work conducting surveillance and investigating the causes of maternal deaths, stillbirths and infant deaths. HQIP commissions this work on behalf NHS England, NHS Wales, the Health and Social Care Division of the Scottish government, the Department of Health, Social Services and Public Safety, Northern Ireland (DHSSPS), the States of Jersey, Guernsey, and the Isle of Man. The MBRRACE-UK collaboration is led from the National Perinatal Epidemiology Unit in the Nuffield Department of Population Health at the University of Oxford.

The aim of the MNI-CORP MBRRACE-UK programme is to provide robust national information to support the delivery of safe, equitable, high quality, patient-centred maternal, newborn and infant health services.

Who is responsible for the data we collect?

Under the General Data Protection Regulation the ‘data controller’ is responsible for what happens to data which is collected. The ‘data controller’ for the MNI-CORP programme is the Healthcare Quality Improvement Partnership (HIQP) who commissions the work. MBRRACE-UK acts as the ‘data processor’.

Personal data we collect about individuals for the MBRRACE-UK programme

We collect information about all mothers in the UK who die during pregnancy or up to one year after the end of pregnancy. We also collected information about all babies who die either during pregnancy (from 22 weeks gestation onwards) and babies who are born alive who die before they are a month old; this involves collecting information about their mother as well. We use this information to look at the rates of maternal and baby deaths. To do this we also use information about all mothers giving birth and all babies born in the UK. We also carry out confidential enquiries to look at the quality of care that was provided to mothers and babies and identify where improvements in care might make a difference to future mothers, babies and families. As well as confidential enquiries where the mother and or baby die we also carry out confidential enquiries where the mother and/or baby was very ill from particular very serious conditions but recovered.

When we are carrying out this work we use personal identifying data, for example, name, address, and NHS number of mothers and babies. This information is only used for particular purposes and importantly, this information is only made available to specified individuals in the MBRRACE-UK team on a ‘need to know’ basis. For example the members of the research team who carry out the data analysis are not given access to the identifying data.

How we use personal data

As a research unit within the university we use personally-identifiable information to conduct research to improve health, health care and health services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information in our research. Health and care research should serve the public interest, which means that before we are able to access to the personal identifiable information which is listed above we have to demonstrate that our research serves the interests of society as a whole.

To ensure we carry out our research to the highest standards we comply with the UK Policy Framework for Health and Social Care Research and other regulatory requirements. For example, we have approval from the Confidentiality Advisory Committee for section 251 approval under the NHS Act 2006 (England and Wales) and the Public Benefit and Privacy Panel for Health and Social Care (Scotland).

How long we keep personal data for

The need to keep personally identifiable information in the long term depends upon the individual research study. For the purposes of MBRRACE-UK we keep the data long enough to enable us to monitor trends over time. We currently hold identifiable information relating to births, and maternal and baby deaths from 2009 onwards.

How we protect data

We ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. To do this we use ‘technical measures’ such as encryption and passwords to protect the individual datasets as well as the systems the datasets are held in. We also use ‘operational measures’ to protect the data, for example, by limiting the number of people who have access to the databases in which identifiable data is held.

We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice. Read the University’s data protection policy.

Sharing identifiable data

Personal identifiable data which is collected and managed by the MBRRACE-UK collaboration will not be shared with anyone else unless this is required as part of the conduct of the MNI-CORP programme or there is special permission in place to do this.

Anonymised data (from which individuals cannot be identified) may be shared with other research groups who are doing similar research. The data which is shared in these circumstances will not include any information to enable individuals to be identified and the data will not be combined with any other information in a way that could lead to individuals being identified. Any information shared will only be used for the purpose of health and care research, and will not be used to contact individuals or to affect their care.

Decisions about who has access to MBRRACE-UK data are made by the data controller HQIP.

The rights of individuals

The rights of individuals to access, change or move their information are limited, as we need to manage information in specific ways in order for the research we carry out to be reliable and accurate. Individuals involved in any study we conduct do however, have the right to withdraw from the study. If this happens we will keep the information that we have already obtained. To safeguard an individual’s rights, we will use the minimum personally-identifiable information possible.

Complaints

The individuals whose data we hold have the right to complain. If you are one of those individuals and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, data.protection@admin.ox.ac.uk who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

More information

Contact us

If you would like to contact us directly for more information about how we use and protect data collected for research conducted at the NPEU, please email Professor Jenny Kurinczuk, Director, National Perinatal Epidemiology Unit at: jenny.kurinczuk@npeu.ox.ac.uk