This notice is provided in compliance with the General Data Protection Regulation 2018. It relates to the use of personally identifiable information the context of research conducted in the National Perinatal Epidemiology Unit.
'MBRRACE-UK' is the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn and Infant clinical Outcome Review Programme (MNI-CORP) which continues the national programme of work conducting surveillance and investigating the causes of maternal deaths, stillbirths and infant deaths. HQIP commissions this work on behalf NHS England, NHS Wales, the Health and Social Care Division of the Scottish government, the Department of Health, Social Services and Public Safety, Northern Ireland (DHSSPS), the States of Jersey, Guernsey, and the Isle of Man. The MBRRACE-UK collaboration is led from the National Perinatal Epidemiology Unit in the Nuffield Department of Population Health at the University of Oxford.
The aim of the MNI-CORP MBRRACE-UK programme is to provide robust national information to support the delivery of safe, equitable, high quality, patient-centred maternal, newborn and infant health services.
Who is responsible for the data we collect?
Under the General Data Protection Regulation the ‘data controller’ is responsible for what happens to data which is collected. The Healthcare Quality Improvement Partnership commissions the MNI-CORP programme in England on behalf of NHS England. HQIP and NHS England are joint data controllers for data relating to England and English residents. For Scotland HQIP and NHS National Services Scotland are data controllers in common for data relating to Scotland and Scottish residents. For the rest of the UK HQIP is the data controller. MBRRACE-UK acts as the ‘data processor’.
Personal data we collect about individuals for the MBRRACE-UK programme
We collect information about all mothers in the UK and British Crown Dependencies (BCDs) who die during pregnancy or up to one year after the end of pregnancy. We also collected information about all babies who die either during pregnancy (from 22 weeks gestation onwards) and babies who are born alive who die before they are a month old; this involves collecting information about their mother as well. We use this information to look at the rates of maternal and baby deaths. To do this we also use information about all mothers giving birth and all babies born in the UK and BCDs.
We also carry out confidential enquiries to look at the quality of care that was provided to mothers and babies and identify where improvements in care might make a difference to future mothers, babies and families. As well as confidential enquiries where the mother and or baby die we also carry out confidential enquiries where the mother and/or baby was very ill from particular very serious conditions but recovered.
When we are carrying out this work we use personal identifying data, for example, name, address, and NHS number of mothers and babies. This information is only used for particular purposes and importantly, this information is only made available to specified individuals in the MBRRACE-UK team on a ‘need to know’ basis. For example the members of the research team who carry out the data analysis are not given access to the identifying data.
The information we use comes from hospitals around the UK and the BCDs. By law each of these organisations is required to display a privacy notice giving details about how they use the information that they collect including how they share information with organisations such as MBRRACE-UK. Hospitals display these notices on their website.
How we use personal data
As a research unit within the university we use personally-identifiable information to conduct research to improve health, health care and health services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information in our research. Health and care research should serve the public interest, which means that before we are able to access to the personal identifiable information which is listed above we have to demonstrate that our research serves the interests of society as a whole.
To ensure we carry out our research to the highest standards we comply with the UK Policy Framework for Health and Social Care Research and other regulatory requirements. For example, we have approval from the Confidentiality Advisory Committee for section 251 approval under the NHS Act 2006 (England and Wales) (20/CAG/0058) and the Public Benefit and Privacy Panel for Health and Social Care (Scotland) (1920-0288). We do not receive identifiable information from Northern Ireland except with consent.
How long we keep personal data for
The need to keep personally identifiable information in the long term depends upon the individual research study. For the purposes of MBRRACE-UK we keep the data long enough to enable us to monitor trends over time. We currently hold identifiable information relating to births, and maternal and baby deaths from 2009 onwards.
How we protect data
We ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. To do this we use ‘technical measures’ such as encryption and passwords to protect the individual datasets as well as the systems the datasets are held in. We also use ‘operational measures’ to protect the data, for example, by limiting the number of people who have access to the databases in which identifiable data is held.
We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice. Read the University’s data protection policy.
Sharing identifiable data
Personal identifiable data which is collected and managed by the MBRRACE-UK collaboration will not be shared with anyone else unless this is required as part of the conduct of the MNI-CORP programme or there is special permission in place to do this.
Anonymised data (from which individuals cannot be identified) may be shared with other research groups who are doing similar research. The data which is shared in these circumstances will not include any information to enable individuals to be identified and the data will not be combined with any other information in a way that could lead to individuals being identified. Any information shared will only be used for the purpose of health and care research, and will not be used to contact individuals or to affect their care.
Decisions about who has access to MBRRACE-UK data are made by the data controller HQIP.
The rights of individuals
The rights of individuals to access, change or move their information are limited, as we need to manage information in specific ways in order for the research we carry out to be reliable and accurate. Individuals involved in any study we conduct do however, have the right to withdraw from the study. If this happens we will keep the information that we have already obtained. To safeguard an individual’s rights, we will use the minimum personally-identifiable information possible.
The individuals whose data we hold have the right to complain. If you are one of those individuals and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, email@example.com who will investigate the matter.
If you would like to contact us directly for more information about how we use and protect data collected for research conducted at the NPEU, please email Professor Jenny Kurinczuk, Director, National Perinatal Epidemiology Unit at: firstname.lastname@example.org