Version 6: Applicable from: 5 August 2022
If you’d like to print this privacy notice or export it as a PDF, please select Ctrl + P on your keyboard (or Cmd+ P for Mac users).
About the 1970 British Cohort Study (BCS70)
About this privacy notice
Giving and withdrawing your permission to take part in BCS70
Contact details of the Data Controller
Contact details of the UCL Data Protection Officer (DPO)
Personal data we collect about you
Lawful basis for processing
Personal information that we collect from other sources
Why we process your data
Your individual information rights
Who we share your data with
Transfers of data outside of the UK
How long we keep your data for
CLS (‘we’, ‘our’ and ‘us’) values your contribution to BCS70 (‘the study’) and understands the importance of protecting your personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018). We are also committed to being honest, fair and responsible when we process your data.
This privacy notice tells you what happens to any personal data that you give to us, or any that we may collect about you. More information about how we use your personal data is available in the privacy and data protection frequently asked questions (FAQs): bcs70.info/home/privacy/faqs.
We ask your permission to be part of the study. We do this so that, after receiving information about how your data will be used, you can choose whether to take part. You can contact us at any time to request to change any of the permissions that you have given. You do not need to give a reason for this.
UCL is the organisation that decides how and why the personal data that you have given to the study is used. In the GDPR and DPA 2018, this means that UCL is the Data Controller. Other organisations have hosted and been data controller of BCS70 in the past. When we share data with other organisations, these organisations may also be Data Controllers. We tell you about how UCL and other organisations that we work with process your data and whether these organisations are data controllers in the information that we provide when we collect data from you. We will also provide this information in the study FAQs about each project or survey: bcs70.info/faqs.
Further information about how we handle your data is available in the privacy and data protection FAQs: bcs70.info/home/privacy/faqs. You can contact us at the details below if you:
Call: 0800 035 5761
Post: 1970 British Cohort Study, Centre for Longitudinal Studies, UCL Social Research Institute, 20 Bedford Way, London WC1H 0AL
More information about how we handle your personal data is available at UCL’s data protection web pages (ucl.ac.uk/data-protection/data-protection-overview/understanding-data-protection-ucl) and UCL research participants’ privacy notice (ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies). If after contacting us, you need more help or wish to complain about how we use your personal data or use any of your individual information rights, please contact UCL’s DPO:
Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT
More information about individual rights and privacy notices is available at the Information Commissioner’s Office (ICO) website: https://ico.org.uk/your-data-matters/. If after contacting UCL, you still have any concerns about the way that we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website: https://ico.org.uk/your-data-matters/raising-concerns/. CLS is included in UCL’s registration with the ICO (number: Z6364106).
BCS70 follows the lives of more than 17,000 people born in England, Scotland and Wales in a single week of 1970. BCS70 documents your life since birth and covers topics such as physical health, mental health and wellbeing and lifestyle, health behaviours, educational attainment, cognition, work and finances, and family. Further information about data collected in the study is available at: https://bcs70.info/home/about/.
Most of the personal data that we hold is collected during a survey and comes directly from you (e.g., contact details, survey responses, biological samples, research data). We have also collected data from your family members and professionals (e.g., teacher or doctor). Access to your personal data is carefully controlled. Personal data, or personal information, means any information about you that can identify you directly or indirectly including:
UCL’s statement of tasks in the public interest 2018 summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ (www.ucl.ac.uk/legal-services/sites/legal-services/files/ucl_statement_of_tasks_in_the_public_interest_-_august_2018.pdf). CLS processes sensitive or special category personal data where it meets the conditions of GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018.
We may also process your personal data where we meet the conditions of GDPR Article 6(c): ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.
We send you marketing materials about the study (such as newsletters) based on your consent (GDPR Article 6(a)).
To receive notifications of deaths and moves out of the NHS for contact tracing and research purposes and health data for research, for England and Wales we apply to the Confidentiality Advisory Group to set aside the common law duty of confidentiality under Section 251 of the National Health Service Act.
The legal bases within GDPR and the Data Protection Act 2018 are separate, and in addition to, the permission you gave to take part in the study.
We link other records to the data collected in the survey as part of our linked data programme (described below). So far, we have linked your health records to the survey data, if you gave permissions for this at the Age 42 Survey.
We also use data from the administrative records of government departments to update your record for contact tracing purposes (described below) and for research purposes. Administrative records are created when you interact with government services (e.g., use the NHS, pay taxes, access benefits etc).
Further information about our records linkage programme and receiving information from other sources is available at the study FAQs: bcs70.info/faqs/#adding-information-to-your-data and the UCL General Privacy Notice: ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies.
Your contact details
We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to BCS70 (e.g., for our linked data programme). Your contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme. Your contact details are never shared with researchers. More information about how your contact details are used is available in the FAQ, ‘How will my information be used?’: bcs70.info/faqs/how-will-my-information-be-used/.
Keeping your records up to date – contact tracing
We ask you for contact details of other people too – including your partner (if you have one) and someone outside of your household, (known as your ‘stable contact’). This is so that if you move to a new home and we’re not able to contact you, we can contact these people to try to find out where you have moved to. Please do tell us if your contact details change.
We also apply to the NHS and government departments for up-to-date contact details and for notifications about study members who have moved out of the UK or who have died. We match the contact details and personal information that we hold with similar data from NHS records or the records of other government departments. The ‘How we find you’ section of the BCS70 site sets out the extensive steps that we take to keep in touch with you and who we share your contact details with to update your record.
Survey and research data
We collect your survey data (and other kinds of research data) with your permission. You have the option to refuse to answer any individual questions without explanation. You can also withdraw from the survey at any time. You do not need to give a reason. We share pseudonymised research data securely for research, statistics and archiving purposes via the UK Data Service and other trusted research environments such as the UK Longitudinal Linkage Collaboration (UK LLC) and SAIL Databank. Pseudonymisation is a technique that replaces or removes information in a dataset that directly identifies you, such as your name and address, and is a security measure taken to reduce any risk of you being identified in our research data. Any analysis is done on grouped data and is not reported as individual answers.
Qualitative research data
Some of you will have taken part in small-scale qualitative research in which you had an open in-depth conversation with a researcher. These interviews are recorded then transcribed so that they can be made available for research. Any information which could allow you to be identified is removed from the transcripts made available to researchers. Copies of the original recordings and transcripts may be retained at CLS. These are stored securely with restricted access within UCL.
Adding information to your record – linked data programme
We link data to your record as part of our linked data programme, to build up a picture of the different dimensions of your life and to produce research with the aim of improving public services.
We may also collect permissions to link data from your family members, or partners. With your permission, we share your contact details and personal information with government departments and agencies, and NHS organisations. We do this to add information about your health and economic circumstances from these organisations’ records to your survey data. This linked data is then pseudonymised and deposited at the UK Data Service and similar research environments. Data linkages are governed by Data Sharing Agreements with other data controllers to ensure that your information is kept secure. This video explains more about adding administrative information, such as health and work, to your survey responses: https://youtu.be/W6ZuK3lYW6Y.
We may also add other data such as a range of publicly available data including Ordnance Survey, housing, energy, environment and weather data to your record. We may also add non-publicly available data to your record, for example, about the school that you attended or grouped data about the area you live in such as level of deprivation. We do not ask your permission for these linkages.
In the COVID-19 web surveys we explained how, if you have downloaded and used the COVID-19 symptom tracker app, we will link the symptom tracker data to your survey responses unless you told us that you did not wish for that to happen.
UK Longitudinal Linkage Collaboration (UK LLC)
All CLS cohort studies are contributors to the UK LLC. This is a major new research programme that will support research into the health and social care impacts of COVID-19 and inform public health and social policy.
How the UK LLC is managed
The UK LLC is run by the University of Bristol (Data Controller of data placed in the UK LLC database) and supported by the University of Swansea (Data Processor for the University of Bristol) UK Secure eResearch Platform (UKSeRP). Digital Health and Care Wales (DHCW) is the UK LLC’s data processor for records linkage.
How your data gets to the UK LLC
If you have given CLS permission for your health records to be linked and took part in the COVID-19 surveys (and didn’t withdraw from the ZOE app), your personal data (such as full name, address, date of birth, sex, NHS ID), and permissions for data linkage will be sent to Digital Health and Care Wales (DHCW) so that they can link your data to your NHS Health records. DHCW will then send your pseudonymised linked data to the UK LLC.
Your biological samples
We have Research Tissue Bank ethical approval for the collection, storage, use and distribution of biological samples. Our collection and destruction of these samples is regulated by the Human Tissue Act 2004.
We gained your permission to collect blood samples from you during the Age 46 survey. We have collected these samples for use in health research, and if you gave us permission, we have stored these samples and will extract DNA for genetic research. You may have received a letter with the results of analysis of your blood sample. Your biological samples are shared securely with accredited biobanks and laboratories that store and process your samples on our behalf or for research purposes.
With your permission, we also collected a blood sample as part of the Covid-19 antibody testing project. Any blood which was left over after the antibody test was conducted was destroyed by the laboratory.
The FAQ ‘Why did you want to take my DNA?’ provides more information about how we will process your DNA. Access to sensitive data is managed by the CLS Data Access Committee. Information about how researchers access data from the study is available on the CLS website at ‘Accessing data directly from CLS’.
We will not provide you with feedback of the results of genetic (DNA) testing. These data are used for research and not clinical diagnostic purposes. This position is considered current ‘best practice’ ethically given we cannot be certain about the clinical relevance of any individual person’s results. However, scientific developments in genetics are happening rapidly and this policy will be regularly reviewed.
Your questionnaires and forms
Where you, your family or contacts, such as your teacher, have completed paper questionnaires as part of the study, we may store original copies or digital scans of these so that we have a record of you taking part in the study and for research purposes. We also store original copies of consent forms and administrative paper records used by interviewers during surveys. Paper copies are stored securely. Digital copies are held in a secure restricted access UCL database. Some of these original copies were collected by other organisations that managed the cohort before us.
You are under no statutory or contractual obligation to provide us with your personal data. The UK GDPR gives individuals information rights. Some of these rights are not absolute as they are dependent on the reason or lawful basis for processing your data. These rights, therefore, may be subject to our policies or ‘exemptions’ (opt outs) allowed by the UK GDPR. You can contact us at any time to tell us:
When you contact us to exercise your rights, we will:
Table 1 summarises the data that we hold about you and who we share this with.
Table 1: Summary of the data that we hold for BCS70 and who we share it with
|Types of data that we hold about you||Controllers||Categories of recipients|
|Contact details, personal information||UCL||Email, marketing automation, and customer engagement service provider
|Survey answers||UCL||Survey agencies|
|Biological samples (e.g., blood from the Age 46 survey).||UCL||Biobanks
|DNA from Age 46 blood sample (pending)
Data derived from biological samples / health metrics, e.g.
|Research data from the study and surveys (e.g., COVID-19 Survey) including:
||UCL (and public sector bodies for specific projects)||Survey agencies
Trusted research data services
|Name, sex, postcode, date of birth, address, National Insurance number (if known), NHS number/ID (if known) and study ID (study-specific pseudonymised
|UCL||Government departments / agencies
Trusted third parties for data linkage (e.g., DCHW)
|Publicly available information from social media (where we have your social media handle), internet searches, directories and databases.||UCL|
|Legacy data (e.g. original questionnaires and consent forms).||UCL||Researchers/research organisations|
|Personal information, sensitive/special category personal data||UCL, relevant authorities/bodies||Public sector bodies/authorities (e.g., police, NHS, social services), your stable contacts|
There may be rare occasions where it may be necessary to use your personal information to protect you or others. For example, when something you tell us indicates that someone is at risk of harm.
We may also share your contact details or personal information securely with other organisations, for projects that you have agreed to be part of, including:
We may also use selected pseudonymised quotes from your survey responses to promote our research findings.
CLS, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we are required to have agreements in place to protect your information in accordance with our legal obligations.
If we share information with other organisations, we will put safeguards in place to ensure that your information is secure.
CLS research data is governed by the principles and procedures set out in our CLS Research Data Access Framework and CLS Data Classification Policy. The CLS Data Classification Policy is in place to enable CLS to manage any disclosure and sensitivity risks associated with sharing research data. Data is classified and, if necessary, pseudonymised before it is shared securely with researchers.
We have people, systems, policies and contracts in place to keep your data secure. UCL has ISO-27001 certification which demonstrates that all efforts are taken to keep your data secure. We also meet the standards of the NHS Digital Data Security and Protection Toolkit (DSPT) when processing data in UCL’s Data Safe Haven. Further information is available at: https://bcs70.info/faqs/how-do-you-keep-my-data-secure/.
We keep your data for as long as is required for the purposes of this longitudinal study and our statutory and legal obligations. We will review the data that we hold whenever we receive an individual rights request from you. Further information on how long we keep records for is included in our records retention schedule.
When you visit our website, it sends cookies to your computer. You can find information about managing cookies in different browsers here:
This privacy notice is updated regularly and was last updated on 5 August 2022.
For more information about how we use your personal data, please see our frequently asked questions.