Privacy Notice for participants in the 1970 British Cohort Study (BCS70)

Privacy Notice for participants in the 1970 British Cohort Study (BCS70)

Version 1: Applicable from: 23 April 2021

Contents

About the 1970 British Cohort Study (BCS70)
About this privacy notice
Cookies
Giving and withdrawing your permission to take part in BCS70
Data controllers
Contact details of the Data Controller
Contact details of the UCL Data Protection Officer (DPO)
Personal data we collect about you
Lawful basis for processing
Personal information that we collect from other sources
Why we process your data
Your individual information rights
Who do we share your data with?
Transfers of data outside of the UK
Data security
How long we keep your data for
Version control

About the 1970 British Cohort Study (BCS70)

BCS70 is one of four national longitudinal cohort studies, housed at the UCL Centre for Longitudinal Studies (CLS):

About this privacy notice

CLS (‘we’, ‘our’ and ‘us’) values your contribution to BCS70 (‘the study’) and understands the importance of protecting personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).

We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the data protection principles as described in our privacy policy. This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect about you. More information about how we use your personal data is available in BCS70’s frequently asked questions (FAQs): bcs70.info/faqs/#privacy-and-data-protection.

Cookies

When you visit our website, it sends cookies to your computer. You can find information about managing cookies in different browsers here:

Firefox
Internet Explorer
Chrome
Safari

Giving and withdrawing your permission to take part in BCS70

BCS70 is a voluntary research study. You are under no statutory or contractual obligation to provide us with your personal data. We ask your permission to be part of the study. We do this so that, after receiving full information about how your data will be used, you can make a decision about whether to take part and, whether to consent to administrative records being linked to your data. You can contact us at the details below to withdraw from the study at any time or to exercise your individual information rights. You can withdraw from the study completely or just from a particular survey or records linkage or from having your biological samples processed.

Data controllers

UCL is the Data Controller as it is the organisation that decides how and why your personal data is processed. The study has been hosted by other organisations in the past. On 2 December 2014, the Institute of Education (IOE) merged with University College London (UCL). CLS is part of the UCL Social Research Institute within the UCL Institute of Education. The relationship between UCL and the organisations that we share your data with is set out in the contracts that we hold with these organisations and the study FAQs. These contracts are in place to ensure that your personal data are protected. We tell you about how UCL and other organisations process your data in the information that we provide when we collect data from you and in the study FAQs: bcs70.info/faqs/#privacy-and-data-protection.

Contact details of the Data Controller

Further information about how we handle your data is available in the study FAQs: bcs70.info/faqs/#privacy-and-data-protection. If you have any questions about how your personal data is processed for BCS70, or you would like to withdraw your consent or update your contact details, you can contact us at:

Call: 0800 0355 761
Email: bcs70@ucl.ac.uk
Post: 1970 British Cohort Study, Centre for Longitudinal Studies, UCL Social Research Institute, 20 Bedford Way, London WC1H 0AL

Contact details of the UCL Data Protection Officer (DPO)

More information about our approach to handling your personal data is available at UCL’s data protection web pages (ucl.ac.uk/data-protection/data-protection-overview/understanding-data-protection-ucl) and UCL research particpants’ privacy notice (ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies). If after contacting us, you need further assistance or wish to complain about our use of your personal data or exercise any of your individual information rights, please contact UCL’s DPO:

Email: data-protection@ucl.ac.uk
Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT.

More information about individual rights and privacy notices is available at the Information Commissioner’s Office (ICO) website: ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/. If after contacting UCL, you still have any concerns about the way in which we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website. CLS is included in UCL’s registration with the ICO (number: Z6364106).

Personal data we collect about you

BCS70 follows the lives of more than 17,000 people born in England, Scotland and Wales in a single week of 1970. BCS70 documents your life since birth and covers topics such as physical health, mental health and wellbeing and lifestyle, health behaviours, educational attainment, cognition, work and finances, and family. Further information about data collected in the study is available at: bcs70.info. Most of the personal data that we hold is collected during a survey and comes directly from you (e.g., contact details, survey responses, biological samples, research data). We have also collected data from your family members and professional contacts (e.g., teacher or doctor). Access to your personal data is carefully controlled. Personal data, or personal information, means any information about you that can identify you directly or indirectly including:

  • Information that directly identifies you such as your name, contact details (for you, your family members or ‘stable contacts’ and your professional contacts such as teacher or doctor) and other personal information (e.g., sex, date of birth, nationality, NHS number, National Insurance number).
  • Sensitive or ‘special category personal data’ about you (e.g., details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health and genetic data). Access to this data is strictly controlled.
  • Information provided by other organisations (e.g., NHS organisations, Department for Work and Pensions) as part of our linked data programme and for contact tracing purposes (e.g., to help us keep study members’ contact details up to date).

Lawful basis for processing

UCL published a statement of tasks in the public interest (www.ucl.ac.uk/legal-services/sites/legal-services/files/ucl_statement_of_tasks_in_the_public_interest_-_august_2018.pdf) in August 2018 which summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ and GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.

The legal basis within GDPR and the Data Protection Act 2018 is separate, and in addition to, the permission you gave to take part in the study. More details about the lawful basis are included in the study FAQ: ‘What is the legal basis on which you can process my data?’.

Personal information that we collect from other sources

We link data to your records as part of our linked data programme (described below). So far, we have linked your health records to your survey data, if you gave permissions for this at the Age 42 Survey. We also use data from the administrative records of government departments to update your record for contact tracing purposes (described below). Further information about our records linkage programme and receiving information from other sources is available at the study FAQs: bcs70.info/faqs/#adding-information-to-your-data and the UCL General Privacy Notice: ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies.

Why we process your data

Your contact details

We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to BCS70 (e.g., the CLS COVID-19 Survey and for our linked data programme). Your contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme. Your contact details are never shared with researchers who process your pseudonymised survey or research data. More information about how your contact details are used is available in the FAQ, ‘How will my information be used’?: bcs70.info/faqs/how-will-my-information-be-used/.

Keeping your records up to date – contact tracing

We ask you for contact details of someone else, usually outside of your household, (known as your ‘stable contact’). This is so that if you move to a new home and we’re not able to contact you, we can contact that person to try to find out where you have moved to. Please do tell us if your contact details change.

We also apply to the NHS and government departments for up to date contact details and for notifications about study members who have moved out of the UK or who have died. We match the contact details and personal information that we hold with similar data from NHS records or the records of other government departments. The ‘How we find you’ section of the BCS70 site sets out the extensive steps that we take to keep in touch with you and who we share your contact details with to update your record.

Survey and research data

We collect your survey data with your permission. We share pseudonymised research data securely for research, statistics and archiving purposes via the UK Data Service and other trusted research environments such as the UK Longitudinal Linkage Collaboration (UK LLC) and SAIL Databank. Pseudonymisation is a technique that replaces or removes information in a dataset that directly identifies you, such as your name and address, and is a security measure taken to reduce any risk of you being identified in our research data. Any analysis is done on grouped data and is not reported as individual answers.

Adding information to your record – linked data programme

We link data to your record as part of our linked data programme, to build up a picture of the different dimensions of your life and to produce research with the aim of improving public services. With your permission, we share your contact details and personal information with government departments and agencies, and NHS organisations. We do this to add information about your health and economic circumstances from these organisations’ records to your survey data. This linked data is then pseudonymised and deposited at the UK Data Service and similar research environments. Data linkages are governed by Data Sharing Agreements with other data controllers to ensure that your information is kept secure. This video explains more about adding administrative information, such as health and work, to your survey responses: https://youtu.be/W6ZuK3lYW6Y.

We may also add other data such as a range of publicly available data including Ordnance Survey, housing, energy, environment and weather data to your record. We may also add non-publicly available data to your record, for example, about the school that you attended or grouped data about the area you live in such as level of deprivation. We do not ask your permission for these linkages as the linked data are not individually about you.

In the COVID-19 web surveys we explained how, if you have downloaded and used the COVID-19 symptom tracker app, we will link the symptom tracker data to your survey responses unless you told us that you did not wish for that to happen.

CLS will also deposit your pseudonymised data with the UK Longitudinal Linkage Collaboration (UK LLC). UK LLC is a UK Government funded initiative to allow for the investigation into high priority COVID-19 research questions and help inform public health policy. The UK LLC is run by the University of Bristol (Data Controller) and supported by the University of Swansea (Data Processor for the University of Bristol) UK Secure eResearch Platform (UKSeRP). The UK LLC platform will link your survey data (including linked data) to your health records (provided to the UK LLC by relevant NHS agencies) and environmental records for research.

Collaborating studies will provide our trusted third party, NHS Wales Informatics Service (NWIS), with identifiable information such as names, addresses, NHS ID (where known). NWIS will de-duplicate these files, combine, and create and apply a number to it. The NHS Wales Information Service will then send these files containing the identifiers to the organisations who own and manage the data, such as the NHS, where they will match the identifiers to the people who are participating in the collaborating studies. The collaborating studies and owners of official records, such as the NHS or the Office for National Statistics, will send the pseudonymised data into the UKSeRP Gateway. UKSeRP will combine de-identified data provided by owners of official records with pseudonymised data provided by the studies using the Key ID. UKSeRP will then create an encrypted Key ID (eKey ID), before the de-identified combined data are stored within the UK LLC. The UK LLC staff have no access to the key which links this UK LLC ID to participant identifiers. This means that only the UK LLC staff (at the University of Bristol) and the IT staff keeping the system safe (at the University of Swansea) have access to all the UK LLC datasets and this is necessary for data management and preparation.

Your biological samples

We gained your permission to collect blood samples from you during the Age 46 survey. We have collected these samples for use in health research, and if you gave us permission, to extract DNA for genetic research. You may have received a letter with the results of analysis of your blood sample including cholesterol and glycated haemoglobin. Your biological samples are shared securely with accredited biobanks and laboratories that store and process your sample on our behalf or for research purposes. For more information, see the FAQ ‘Why did you want to take my DNA?’. Our collection and destruction of these samples is regulated by the Human Tissue Act 2004. Access to sensitive data is managed by the CLS Data Access Committee. Information about how researchers access data from the study is available on the CLS website at ‘Accessing data directly from CLS’.

Your paper questionnaires and forms

Where you, your family or contacts, such as your teacher, have completed paper questionnaires as part of the study, we may store original copies or digital scans of these so that we have a record of you taking part in the study and for research purposes. Original copies are stored securely. Digital copies are held in a secure restricted access UCL database. Some of these original copies were collected by other organisations that managed the cohort before us.

Your individual information rights

Under the GDPR, where exemptions do not apply and our policies allow, you have the right to tell us:

  • to inform you about how your information is being used. We do this in this document.
  • to give you access to copies of your personal information.
  • to rectify information that is factually inaccurate or misleading (e.g., to correct incorrect contact details).
  • to erase (delete) your data in certain circumstances, (e.g., to delete incorrect contact details or data that is no longer required or we’re legally required to erase). If we receive a deletion request from you, we will stop collecting, linking and depositing your data. However, we will not be able to delete data that was pseudonymised and deposited for research purposes previously, before we received your request. We will also delete your biological samples and data, including DNA, according to the Human Tissue Act 2004 and the terms of your study agreement form. For more information, please see the FAQs: ‘Blood and DNA samples from the Age 46 survey’. Data shared with external organisations that provide services to us are deleted when we receive a valid request from you, or at the end of the contract or project or according to the specific terms of the contract.
  • to restrict (limit) processing of your data in certain circumstances, for example if your contact details are incorrect.
  • you object to the way we process your data.
  • you want to use the right to data portability: You can receive a copy of your electronically held data and reuse it. We cannot send your data to others at your request.
  • you want to use your right to object to solely automated decision making and profiling with legal effects for you: We use your data for research purposes and not to make decisions that would affect you individually.

When you contact us to exercise your rights, we will:

  • tell you that your request has been received
  • write to tell you if your request is not applicable and give the reasons
  • act on your request within the time period required by the current data protection law
  • write to inform you if we need to extend the period of time required to respond due to the complexity

Who do we share your data with?

Table 1 summarises the data that we hold about you and who we share this with.

Table 1: Summary of the data that we hold for BCS70 and who we share it with

Types of data that we hold about you Controllers Categories of recipients Purposes of sharing your data
Contact details, personal information and survey answers. UCL Mailing  and survey agencies To contact you and keep your record up to date for the purposes of BCS70.
Biological samples (blood /DNA) UCL Nurse/survey agency
Courier services
Licenced laboratories Researchers/research organisations Biobanks
To collect and process your sample for research, statistical and archiving purposes.
Research data from the study, surveys (e.g., COVID-19 Survey) including:
– Genetic data linked to survey results
– Data from the data linkage programme (from NHS organisations, government departments, research and statistics organisations, databanks, other data controllers in the private sector).
UCL (and public sector bodies for specific projects) Survey agencies
Biobanks
Trusted research data services
Researchers/research organisations
For research, statistics and archiving purposes.
Name, sex, postcode, date of birth, address, National Insurance number (if known), NHS number/ID (if known) and study ID (study-specific pseudonymised
identifier).
UCL Government Departments
NHS organisations
Trusted third parties for data linkage Research/statistics organisations
To add information to your record.
For research purposes.
For contact tracing.
Legacy data (original questionnaires and consent forms). UCL Researchers/research organisations For archiving and research purposes.

We may also share your contact details or personal information securely with other organisations, for projects that you have agreed to be part of, including:

  • Thriva, a healthcare company which does COVID-19 antibody tests (these results will be deposited in pseudonymised format with trusted research environments, including the UK LLC and the UK Data Service). We will notify Public Health England of all results from all UK nations and Public Health England may in turn provide these results to equivalent bodies in Scotland, Wales and Northern Ireland.
  • Video-conferencing companies whose software we use where we cannot do in person surveys due to COVID-19.

We may also use selected pseudonymised quotes from your survey responses to promote our research findings.

Transfers of data outside of the UK

CLS, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we have agreements in place to protect your information in accordance with our legal obligations.

Data security

CLS research data are governed by the principles and procedures set out in our CLS Research Data Access Framework and CLS Data Classification Policy. If we share information with other organisations, we will put safeguards in place to ensure that your information is secure.
Data is classified and, if necessary, pseudonymised before it is shared securely with researchers. We have people, systems, policies and contracts in place to keep your data secure. UCL has ISO-27001 certification which demonstrates that all efforts are taken to keep your data secure. More information about how we keep your data secure is available at ‘What safeguards do we have in place to protect your personal information?’.

How long we keep your data for

We keep your data for as long as is required for the purposes of the BCS70 longitudinal study and our statutory and legal obligations. Our Records Management Policy and Records Retention Schedule ensure that all CLS records, whether paper, digital, email or audio-visual are managed in line with records management principles. Further information on how long we keep records for is included in our records retention schedule.

Version control

This privacy notice is updated regularly and was last updated on 23 April 2021

 

For more information about how we use your personal data, please see our frequently asked questions.

In this section