Privacy Notice

Version 7: Applicable from: 01 February 2023

 

Contents

About the 1970 British Cohort Study (BCS70)
About this privacy notice
Giving and withdrawing your permission to take part in BCS70
Data controllers
Contact details of the Data Controller
Contact details of the UCL Data Protection Officer (DPO)
Lawful basis for processing
Personal data we collect about you
Personal information that we collect from other sources
Why we process your data
Who we share your data with
Transfers of data outside of the UK
Data security
How long we keep study data for
Complaints
Cookies
Further information
Version control

About the 1970 British Cohort Study (BCS70)

BCS70 is one of several national longitudinal cohort studies at the UCL Centre for Longitudinal Studies (CLS). BCS70 follows the lives of more than 17,000 people born in England, Scotland, and Wales in a single week of 1970. BCS70 documents your life since birth and covers topics such as physical health, mental health, wellbeing and lifestyle, health behaviours, educational attainment, cognition, work and finances, and family. We share our findings from the study with researchers who are discovering the topics that affect your generation.

About this privacy notice

CLS (‘we,’ ‘our’ and ‘us’) values your contribution to BCS70 (‘the study’). We respect your privacy and are committed to protecting your personal data. This privacy notice tells you why and how we collect and use your personal data and provides information about your rights. This privacy notice applies to personal data provided to us, by you and about you by third parties. This privacy notice is for anyone whose data that we hold for the research purposes of the study including:

  • Study cohort members.
  • Family members of study cohort members (such as parents, partners, siblings, children, or other household members).

We use the terms ‘you’ or ‘your’ in this document when referring to study cohort members

Giving and withdrawing your permission to take part in BCS70

We seek your informed consent to be part of the study. We provide you with appropriate information about the study and how your information will be used. We do this so that you know what to expect when you choose whether you would like to take part. You can tell us at any time that you no longer want to be contacted about the study or you want to change the permissions that you have given. You do not need to give a reason for this. Consent is not our UK GDPR lawful basis for processing study data for research purposes. The lawful basis section below gives more information about this.

Data controllers

UCL is the Data Controller of the study. Other organisations have been the data controller of BCS70 in the past. When we share data with other organisations, these organisations may also be Data Controllers. We tell you about how UCL and other organisations that we work with process your data and whether these organisations are data controllers in the information that we provide when we collect data from you.

Contact details of the Data Controller

You can contact us at the details below if you:

  • Have any questions about the study or the way that we process your data
  • Want to withdraw from the study, or from a survey, or from having your records linked or biological samples stored or used
  • Want to use your individual information rights
  • Want to update your contact details

Call: 0800 035 5761
Email: bcs70@ucl.ac.uk
Post: 1970 British Cohort Study, Centre for Longitudinal Studies, UCL Social Research Institute, 20 Bedford Way, London WC1H 0AL

Contact details of the UCL Data Protection Officer (DPO)

If after contacting us, you need more help or wish to complain about how we use your personal data or use any of your individual information rights, please contact UCL’s DPO:

Email: data-protection@ucl.ac.uk

Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT.

Lawful basis for processing

Study data is processed for research purposes under GDPR Article 6 (e) ‘Public task’. CLS processes sensitive or special category personal data for research purposes under Schedule 1, Paragraph 4 of the DPA 2018. Consent is not the UK GDPR lawful basis for processing study data for research purposes.

If required, we may also process your personal data according to GDPR Article 6(c): ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.

We send you marketing materials about the study (such as newsletters) based on your consent

(GDPR Article 6(a)).

To receive notifications of deaths and moves out of the NHS for contact tracing and research purposes and health data for research, for England and Wales we apply to the Confidentiality Advisory Group to set aside the common law duty of confidentiality under Section 251 of the National Health Service Act. The legal bases within GDPR and the Data Protection Act 2018 are separate and in addition to, the permission you gave to take part in the study.

Personal data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. Access to personal data is strictly controlled. The study collects, uses, stores, deposits, shares, and transfers different kinds of personal data about study members to understand what life is like for your generation. The data that we hold for the study includes:

 

Information that you share with us during surveys:

  • Sensitive / special category personal data (g., details about race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about health and genetic data).
  • Biological samples: from the Age 46 Biomedical Survey (if you agreed to give samples).
  • Original questionnaires and consent forms

 

Information from the data that you share with us during surveys:

  • Research data from your survey answers: We hold sensitive research data and other research data that could potentially identify you. This includes research data from all of the study surveys, sensitive data, and linked data. The information that would identify you is removed from this data before it is safely deposited at national data sharing stores.
  • Genetic information from your biological samples (if you agreed to this): Once analysed, this will include information about your genotype. This data is stored securely and will be used for research purposes under restricted access arrangements.

 

Information provided by other organisations: as part of our linked data programme (e.g., government departments and agencies such as NHS organisations, Department for Work and Pensions) and for contact tracing purposes (e.g., to help us keep your contact details up to date).

 

Data relating to family members of study cohort members

During surveys we have asked you to provide information about family members.

Family members may also have provided information about themselves by participating in surveys or by taking part in our linked data programme.

Personal information that we collect from other sources

We collect information from external sources for contact tracing and research into the topics that affect your generation. We link records from external sources to the data collected in surveys as part of our linked data programme (described below). We have asked permission to link data about cohort members’ partners and hope to conduct this linkage in the near future. So far, we have linked your health records to the survey data, if you gave permissions for this at the Age 42 Survey. Linked data is pseudonymised and deposited at the UK Data Service and similar research environments.

We hold data about the partners, household, parents, children, and professional contacts of study cohort members that have been supplied by study cohort members during a survey.

Data about study cohort members has also been collected from family members of study cohort members and study cohort members’ teachers.

We have also collected data from professionals (e.g., teacher or doctor).

We also receive information when our website is used (e.g., from cookies or similar technologies).

Why we process your data

We process your data to keep in contact with you, to carry out and share our research about the topics that you experience in your life and to keep a record of our contact with you:

1. Keeping in touch with you

Your contact details

We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to the study. Contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme.

 

Contact tracing

We ask you for contact details of other people too – including your partner (if you have one) and someone outside of your household, (known as your ‘stable contact’). This is so that if you move to a new home and we’re not able to contact you, we can contact these people to try to find out where you have moved to. Please do tell us if your contact details change. If you provide us with contact details for anyone else, please check with them that they are happy for us to hold this information. Please let us know if not and we are happy to remove these details if they do not wish for us to hold them.

We also apply to the NHS and government departments for up-to-date contact details and for notifications about study members who have moved out of the UK or who have died. We match the contact details and personal information that we hold with similar data from NHS records or the records of other government departments. We also use data checking services and information that you’ve made publicly available online to update your contact details.

2. Research into the topics that affect your life

Survey and research data

We collect your survey data (and other kinds of research data) with your permission to understand the things that are important to your generation. You have the option to refuse to answer any individual questions without explanation. You can also withdraw from the survey at any time. You do not need to give a reason. We share pseudonymised research data securely and under licence arrangements for research purposes via the UK Data Service and other trusted research environments such as the UK Longitudinal Linkage Collaboration (UK LLC) and SAIL Databank. Information that would identify you is removed from this data.

 

Qualitative research data

Some of you will have taken part in small-scale qualitative research in which you had an open in-depth conversation with a researcher. Recordings and/or transcripts of these interviews have been kept where you provided permission. These interviews are recorded then transcribed so that they can be made available for research. Any information which could allow you to be identified is removed from the transcripts made available to researchers. Copies of the original recordings and transcripts may be retained at CLS. These are stored securely with restricted access within UCL.

 

Linked data programme

Our linked data programme links a range of external data to study records to build up a fuller picture of participants’ lives. With your permission, we use your personal information to link data from government agencies (e.g., about your health, employment, and finances) to your study record. Data from government agencies is generated when people use government services or come into contact with them.

We ask study members if they would allow us to approach their partners to ask if they would be willing to allow us to access information from their government records (from government agencies such as NHS organisations, Department for Work and Pensions). Permission to access these records has to be received directly from partners. We have not yet added any information related to partners but hope to do so in the near future.

Your address and postcode (and previous addresses) are also used to match data on your location/neighbourhood to your study data. The information that we add is about your local area as a whole, your street or sometimes your specific address. This includes a broad range of data including Ordnance Survey, housing, environment, weather data or economic characteristics of your area such as deprivation levels. We have also sometimes asked you for the postcodes of other members your family (e.g. your parents).   We use these to add information about the local area in which they live and to calculate the distance between family members.  We also add other data to your record, for example, about the characteristics of the school that you attended.

We do not ask your permission to add this kind of information because the data is not individual level information about you. Usually, this information is publicly available and adding this information does not require us to share any of your personal information with any other organisations.

In the COVID-19 web surveys we explained how, if you have downloaded and used the COVID-19 symptom tracker app, we will link the symptom tracker data to your survey responses unless you opted out. This linked data will be pseudonymised and deposited with the UK LLC.

We also use data from the records of government departments to update your record for contact tracing purposes (described above) and for research into health and mortality.

 

UK Longitudinal Linkage Collaboration (UK LLC)

All CLS cohort studies are contributors to the UK LLC. UK LLC is a major UK government-funded research initiative that helps researchers investigate the effects of COVID-19 and its implications for public health policy. UK LLC brings together pseudonymised study data from multiple UK longitudinal studies with pseudonymised copies of study participants’ NHS COVID-19 data, education data, occupation data and information related to where people live. UK LLC data is made available to approved researchers in the UK under licence and secure access arrangements.

University of Bristol is Data Controller of data placed in the UK LLC database. University of Swansea is Data Processor for the University of Bristol UK Secure eResearch Platform (UKSeRP). Digital Health and Care Wales (DHCW) is the UK LLC’s data processor for records linkage.

CLS sends your pseudonymised survey responses to the UK SeRP together with a unique ID. If you have given CLS permission for your health records to be linked, CLS sends your personal data (such as full name, address, date of birth, sex, NHS ID) unique ID to Digital Health and Care Wales (DHCW). DHCW send your personal data and a different unique ID to the agencies that hold your health records, such as NHS Digital. Those agencies will then send your pseudonymised linked data to the UKSeRP who link your study responses and health data together before assigning an encrypted ID and passing them to the UK LLC. Your survey responses will always be kept separate from your personal data that identifies you directly (name, address etc).

 

Your biological samples

We have Research Tissue Bank ethical approval for the storage, use and distribution of biological samples. Our collection, storage and use of these samples is regulated by the Human Tissue Act 2004.

We gained your permission to collect blood samples from you during the Age 46 survey. We have collected these samples for use in health research, and if you gave us permission, we have stored these samples and have extracted DNA from them for genetic research. Your biological samples are shared securely with accredited biobanks and laboratories that store and process your sample on our behalf or for research purposes.

With your permission, we also collected a blood sample as part of the Covid-19 antibody testing project. Any blood which was left over after the antibody test was conducted was destroyed by the laboratory.

We will not provide you with feedback of the results of genetic (DNA) testing. This data is used for research and not clinical diagnostic purposes. This position is considered current ‘best ethical practice’ given we cannot be certain about the clinical relevance of any individual person’s results. However, scientific developments in genetics are happening rapidly and this policy will be regularly reviewed.

 

3. Research, record keeping and archiving

Questionnaires, forms, and requests

Where you, your family, or contacts, such as your teacher, have completed paper questionnaires as part of the study, we may store original copies or digital scans of these so that we have a record of you taking part in the study and for research purposes. We also store original copies of consent forms and administrative paper records used by interviewers during surveys. Paper copies are stored securely. Digital copies are held in a secure restricted access UCL database. Some of these original copies were collected by other organisations that managed the cohort before us. We also keep a record of any requests that we have had from you.

Individual information rights

Study members are under no statutory or contractual obligation to provide us with personal data. The UK GDPR gives people rights over their data. Some of these rights depend on the reason for collecting personal data and do not apply in every circumstance. These rights, therefore, may be subject to our policies or ‘exemptions’ (opt outs) allowed by the UK GDPR. You can contact us at any time to tell us:

  • you want to withdraw your consent (where we are processing your data based on consent)
  • to inform you about how your information is being used. We do this on this page.
  • to give you access to copies of your personal information.
  • to rectify information that is factually inaccurate or misleading (e.g., to correct incorrect contact details).
  • to erase (delete) your data in certain circumstances, (e.g., to delete incorrect contact details or data that is no longer required, or we’re legally required to erase). If we receive a deletion request from you, we will stop collecting, linking, and depositing your data. However, we will not be able to delete data that was pseudonymised and deposited for research purposes previously before we received your request. We will also delete your biological samples and data, according to the terms of the permissions that you gave to the study. Data shared with external organisations that provide services to us are deleted when we receive a valid request from you, or at the end of the contract or project or according to the specific terms of the contract.
  • to restrict (limit) processing of your data in certain circumstances, for example if your contact details are incorrect.
  • you object to the way we process your data.
  • you want to use the right to data portability: You can receive a copy of your electronically held data and reuse it. We cannot send your data to others at your request.
  • you want to use your right to object to solely automated decision making and profiling with legal effects for you: We normally use your data for research purposes and not to make decisions that would affect you individually.

When you contact us to exercise your rights, we will:

  • tell you that your request has been received
  • write to tell you if your request is not applicable and give the reasons
  • act on your request within the time period required by the current data protection law
  • write to inform you if we need to extend the period of time required to respond due to the complexity

Who we share your data with

Table 1 summarises the data that we hold about you and who we share this with.

Table 1: Summary of the data that we hold for BCS70 and who we share it with:

Types of data that we hold about you Controllers Categories of recipients Purposes of sharing your data</strong
Name, contact details (for you, your family members or ‘stable contacts’ and your professional contacts)

 

Personal information

 

(e.g., name, address, email address, telephone number, sex, date of birth, NI Number).

UCL Contact tracing services

International email, marketing automation, and customer engagement service provider

Health data insights companies

Survey agencies

To stay in contact about the study
Survey answers UCL Health data insights companies
Survey agencies
For research into the issues that affect your generation.
Biological samples (e.g., blood from the Age 46 survey). UCL Biobanks
Courier services
Health data insights companies
International Licenced laboratories
Nurse/survey agency
Researchers
Research organisations
Courier services
To collect and process your sample for health and DNA research
DNA from Age 46 blood sample

 

 

Data derived from biological samples and health metrics: e.g.,

Blood test results

Blood group type

DNA information, and potentially whole genome sequence data and other genomic datasets

Height

Weight

UCL Biobanks

Licenced laboratories

Researchers

Research organisations

GPs (blood test results are shared with permission)

To collect and process your sample for health and DNA research
Research data from the study and surveys including:

  • Genetic data linked to survey results
  • Pseudonymised data from the data linkage programme (including data received from NHS organisations, government departments, research and statistics organisations, databanks,- Data from data controllers in the private sector
  • Recordings and transcripts of qualitative interviews
UCL (and public sector bodies for specific projects) Survey agencies

Biobanks

Trusted research data services

Researchers/research organisations

Government departments

Policy makers

Charities

UK LLC

Transcription service

For health, DNA, and social research.
Name, sex, postcode, date of birth, address, National Insurance number (if known), NHS number/ID (if known) and study ID (study-specific pseudonymised
identifier).
UCL Government departments

NHS organisations

Trusted third parties for data linkage (e.g., DCHW)

Research/statistics organisations
Data controllers in the private sector

To stay in contact about the study
For our records linkage programme.
Mortality data
Information about where you live
Other information about external data controllers
Health data.
UCL Research/statistics organisations To stay in contact about the study.
For our linked data programme.
For research purposes.
Externally available information (e.g., contact details from social media) internet searches, directories, and databases. Information from data controllers. UCL To stay in contact about the study
Legacy data (e.g. original questionnaires and consent forms). UCL Researchers/research organisations For social research and archiving purposes
Personal information, sensitive/special category personal data UCL, relevant authorities/bodies Public sector bodies/authorities (e.g., police, NHS, social services), your stable contacts To meet our legal obligations. For safeguarding purposes
Personal information UCL UCL staff and third parties involved in managing participant contact and data security To keep a record of participation in the study and manage contact with participants and data security.

There may be rare occasions where it may be necessary to use your personal information to protect you or others. For example, when something you tell us indicates that someone is at risk of harm. We may share this information with your stable contacts or appropriate public sector bodies.

We share your contact details or personal information securely with other organisations, for projects that you have agreed to be part of, including:

  • Thriva, a healthcare company which does COVID-19 antibody tests (these results will be deposited in pseudonymised format with trusted research environments, including the UK LLC and the UK Data Service). We will notify Public Health England of all results from all UK nations and Public Health England may in turn provide these results to equivalent bodies in Scotland, Wales, and Northern Ireland.
  • Video-conferencing companies whose software we use where we cannot do in person surveys due to COVID-19.

We may also use selected pseudonymised quotes from your survey responses to promote our research findings.

Transfers of data outside of the UK

CLS, and the organisations that we work with, transfer personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we are required to have agreements in place to protect this information in accordance with the law.

Data security

We have put in place appropriate security and organisational measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We have established procedures to deal with any suspected personal data breach and will notify study members and any applicable public body of a breach where we are legally required to do so.

How long we keep your data for

As the study follows study members’ whole life course, we keep study data for at least as long as the study exists and as long as the law allows us to. We will review the data that we hold whenever we receive an individual rights request. Further information on how long we keep records for is included in the UCL records retention schedule: https://www.ucl.ac.uk/library/about-us/records-office/records-retention.

Complaints

Those who wish to complain about our use of personal data, may send an email with the details of the complaint to the Data Protection Officer (data-protection@ucl.ac.uk )so that we can look into the issue and respond.

Study members also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (the UK data protection regulator). For further information on information rights and how to complain to the ICO, please refer to the ICO website: https://ico.org.uk/.

Cookies

When people visit our site, cookies are sent to their computer. Cookies are small text files placed on devices which web servers use to produce information about how our site is used.

Further information

This privacy notice supplements the following UCL Privacy Notice(s):

Research participants for health case purposes privacy notice: https://www.ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies

More information about how we use personal data including how we keep it secure is available in the privacy and data protection frequently asked questions (FAQs): https://bcs70.info/home/privacy/faqs/ .

Version control

We keep this privacy notice under regular review to make sure it is up to date. The last update was on: 01 February 2023.