This notice is provided in compliance with the General Data Protection Regulation 2018. It relates to the use of personally identifiable information the context of research conducted in the National Perinatal Epidemiology Unit.
The National Perinatal Epidemiology Unit (NPEU) is a research unit in the Nuffield Department of Population Health at the University of Oxford. Our mission is to conduct methodologically rigorous research to provide evidence to improve the care provided to women, babies and families during pregnancy, childbirth, the newborn period and early childhood as well as promoting the effective use of resources by perinatal health services.
To achieve our mission we carry out different types of research studies. For example, these range from clinical trials of new treatments, studies where we collect information from hospital records, studies where we collect information directly from pregnant women and parents using questionnaires, and studies where we interview people in groups or as individuals. This notice is designed to provide general information about what we do with the research data that we collect when it includes personally-identifiable information.
Who is responsible for the data we collect?
Under the General Data Protection Regulation the ‘data controller’ is responsible for what happens to data which is collected. The ‘data controller’ for our research varies depending upon the sponsoring organisation for each study. The sponsoring organisation can be the University of Oxford, another University we are collaborating with, or the organisation who commissioned the research. The NPEU acts as the ‘data processor’.
Personal data we collect about individuals in our research studies
How we collect data about the individual mothers, fathers and babies in our studies depends upon the research question we are addressing with each particular study, and the type of study we are carrying out to address the particular research question.
When we are carrying out our research studies which involves collecting personal identifying data, for example, name, address, NHS number and contact details, this information is only collected with a particular purpose in mind. Importantly, this information is only made available to specified individuals in the study research team on a ‘need to know’ basis. For example the members of the research team who carry out the data analysis are not given access to the identifying data.
How we use personal data
As a research unit within the university we use personally-identifiable information to conduct research to improve health, health care and health services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information in our research. This means that if individuals agree to take part in a research study, we will use their data in the ways needed to conduct the research study and analyse the results. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole.
To ensure we carry out our research to the highest standards we comply with the UK Policy Framework for Health and Social Care Research and other regulatory requirements, for example, our clinical trials follow the Clinical Trials Directive 2001/20/EC. We also apply for relevant approval, for example, to the Health Research Authority for research ethics committee approval and in some circumstances to the Confidentiality Advisory Committee for section 251 approval under the NHS Act 2006.
How long we keep personal data for
The need to keep personally identifiable information in the long term depends upon the individual research study. For some studies there is no need to keep this information once the study is complete and for others there is a particular need to keep the identifiable information. For example, for our clinical trials we keep identifiable information for at least 25 years after the study has finished in order to be able to contact the people involved in the study in the unlikely event that a very long term effect of the treatment is discovered or needs further research.
How we protect data
We ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. To do this we use ‘technical measures’ such as encryption and passwords to protect the individual datasets as well as the systems the datasets are held in. We also use ‘operational measures’ to protect the data, for example, by limiting the number of people who have access to the databases in which identifiable data is held.
We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice. Read the University’s data protection policy.
Sharing identifiable data
Personal identifiable data which is collected and managed by the NPEU will not be shared with anyone else unless this is required as part of the conduct of the research. For example, we sometimes ‘link’ information obtained in our studies to information collected by hospitals or by the Office for National Statistics to identify when study participants are admitted to hospital or have died. To do this we have to share the identifiable information. We also use the information to make contact with study participants when they have agreed to be followed up. For example, for our clinical trials the identifiable information allows us to carry out follow-up and to send study participants a summary of the trial results.
At the end of any study anonymised data (from which individuals cannot be identified) may be shared with other research groups who are doing similar research. The data which is shared in these circumstances will not include any information to enable individuals to be identified and the data will not be combined with any other information in a way that could lead to individuals being identified. Any information shared will only be used for the purpose of health and care research, and will not be used to contact individuals or to affect their care. It will not be used to make decisions about future services available to individuals, such as insurance.
The rights of individuals
The rights of individuals to access, change or move their information are limited, as we need to manage information in specific ways in order for the research we carry out to be reliable and accurate. Individuals involved in a study do however, have the right to withdraw from the study. If this happens we will keep the information that we have already obtained. To safeguard an individual’s rights, we will use the minimum personally-identifiable information possible.
The individuals whose data we hold have the right to complain. If you are one of those individuals and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, email@example.com who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).
If you would like to contact us directly for more information about how we use and protect data collected for our research, please email Professor Jenny Kurinczuk, Director, National Perinatal Epidemiology Unit at: firstname.lastname@example.org