Version 1: Applicable from: 23 April 2021
About the 1970 British Cohort Study (BCS70)
About this privacy notice
Giving and withdrawing your permission to take part in BCS70
Contact details of the Data Controller
Contact details of the UCL Data Protection Officer (DPO)
Personal data we collect about you
Lawful basis for processing
Personal information that we collect from other sources
Why we process your data
Your individual information rights
Who do we share your data with?
Transfers of data outside of the UK
How long we keep your data for
BCS70 is one of four national longitudinal cohort studies, housed at the UCL Centre for Longitudinal Studies (CLS):
CLS (‘we’, ‘our’ and ‘us’) values your contribution to BCS70 (‘the study’) and understands the importance of protecting personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).
When you visit our website, it sends cookies to your computer. You can find information about managing cookies in different browsers here:
BCS70 is a voluntary research study. You are under no statutory or contractual obligation to provide us with your personal data. We ask your permission to be part of the study. We do this so that, after receiving full information about how your data will be used, you can make a decision about whether to take part and, whether to consent to administrative records being linked to your data. You can contact us at the details below to withdraw from the study at any time or to exercise your individual information rights. You can withdraw from the study completely or just from a particular survey or records linkage or from having your biological samples processed.
UCL is the Data Controller as it is the organisation that decides how and why your personal data is processed. The study has been hosted by other organisations in the past. On 2 December 2014, the Institute of Education (IOE) merged with University College London (UCL). CLS is part of the UCL Social Research Institute within the UCL Institute of Education. The relationship between UCL and the organisations that we share your data with is set out in the contracts that we hold with these organisations and the study FAQs. These contracts are in place to ensure that your personal data are protected. We tell you about how UCL and other organisations process your data in the information that we provide when we collect data from you and in the study FAQs: bcs70.info/faqs/#privacy-and-data-protection.
Further information about how we handle your data is available in the study FAQs: bcs70.info/faqs/#privacy-and-data-protection. If you have any questions about how your personal data is processed for BCS70, or you would like to withdraw your consent or update your contact details, you can contact us at:
More information about our approach to handling your personal data is available at UCL’s data protection web pages (ucl.ac.uk/data-protection/data-protection-overview/understanding-data-protection-ucl) and UCL research particpants’ privacy notice (ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies). If after contacting us, you need further assistance or wish to complain about our use of your personal data or exercise any of your individual information rights, please contact UCL’s DPO:
Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT.
More information about individual rights and privacy notices is available at the Information Commissioner’s Office (ICO) website: ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/. If after contacting UCL, you still have any concerns about the way in which we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website. CLS is included in UCL’s registration with the ICO (number: Z6364106).
BCS70 follows the lives of more than 17,000 people born in England, Scotland and Wales in a single week of 1970. BCS70 documents your life since birth and covers topics such as physical health, mental health and wellbeing and lifestyle, health behaviours, educational attainment, cognition, work and finances, and family. Further information about data collected in the study is available at: bcs70.info. Most of the personal data that we hold is collected during a survey and comes directly from you (e.g., contact details, survey responses, biological samples, research data). We have also collected data from your family members and professional contacts (e.g., teacher or doctor). Access to your personal data is carefully controlled. Personal data, or personal information, means any information about you that can identify you directly or indirectly including:
UCL published a statement of tasks in the public interest (www.ucl.ac.uk/legal-services/sites/legal-services/files/ucl_statement_of_tasks_in_the_public_interest_-_august_2018.pdf) in August 2018 which summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ and GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.
The legal basis within GDPR and the Data Protection Act 2018 is separate, and in addition to, the permission you gave to take part in the study. More details about the lawful basis are included in the study FAQ: ‘What is the legal basis on which you can process my data?’.
We link data to your records as part of our linked data programme (described below). So far, we have linked your health records to your survey data, if you gave permissions for this at the Age 42 Survey. We also use data from the administrative records of government departments to update your record for contact tracing purposes (described below). Further information about our records linkage programme and receiving information from other sources is available at the study FAQs: bcs70.info/faqs/#adding-information-to-your-data and the UCL General Privacy Notice: ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies.
Your contact details
We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to BCS70 (e.g., the CLS COVID-19 Survey and for our linked data programme). Your contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme. Your contact details are never shared with researchers who process your pseudonymised survey or research data. More information about how your contact details are used is available in the FAQ, ‘How will my information be used’?: bcs70.info/faqs/how-will-my-information-be-used/.
Keeping your records up to date – contact tracing
We ask you for contact details of someone else, usually outside of your household, (known as your ‘stable contact’). This is so that if you move to a new home and we’re not able to contact you, we can contact that person to try to find out where you have moved to. Please do tell us if your contact details change.
We also apply to the NHS and government departments for up to date contact details and for notifications about study members who have moved out of the UK or who have died. We match the contact details and personal information that we hold with similar data from NHS records or the records of other government departments. The ‘How we find you’ section of the BCS70 site sets out the extensive steps that we take to keep in touch with you and who we share your contact details with to update your record.
Survey and research data
We collect your survey data with your permission. We share pseudonymised research data securely for research, statistics and archiving purposes via the UK Data Service and other trusted research environments such as the UK Longitudinal Linkage Collaboration (UK LLC) and SAIL Databank. Pseudonymisation is a technique that replaces or removes information in a dataset that directly identifies you, such as your name and address, and is a security measure taken to reduce any risk of you being identified in our research data. Any analysis is done on grouped data and is not reported as individual answers.
Adding information to your record – linked data programme
We link data to your record as part of our linked data programme, to build up a picture of the different dimensions of your life and to produce research with the aim of improving public services. With your permission, we share your contact details and personal information with government departments and agencies, and NHS organisations. We do this to add information about your health and economic circumstances from these organisations’ records to your survey data. This linked data is then pseudonymised and deposited at the UK Data Service and similar research environments. Data linkages are governed by Data Sharing Agreements with other data controllers to ensure that your information is kept secure. This video explains more about adding administrative information, such as health and work, to your survey responses: https://youtu.be/W6ZuK3lYW6Y.
We may also add other data such as a range of publicly available data including Ordnance Survey, housing, energy, environment and weather data to your record. We may also add non-publicly available data to your record, for example, about the school that you attended or grouped data about the area you live in such as level of deprivation. We do not ask your permission for these linkages as the linked data are not individually about you.
In the COVID-19 web surveys we explained how, if you have downloaded and used the COVID-19 symptom tracker app, we will link the symptom tracker data to your survey responses unless you told us that you did not wish for that to happen.
CLS will also deposit your pseudonymised data with the UK Longitudinal Linkage Collaboration (UK LLC). UK LLC is a UK Government funded initiative to allow for the investigation into high priority COVID-19 research questions and help inform public health policy. The UK LLC is run by the University of Bristol (Data Controller) and supported by the University of Swansea (Data Processor for the University of Bristol) UK Secure eResearch Platform (UKSeRP). The UK LLC platform will link your survey data (including linked data) to your health records (provided to the UK LLC by relevant NHS agencies) and environmental records for research.
Collaborating studies will provide our trusted third party, NHS Wales Informatics Service (NWIS), with identifiable information such as names, addresses, NHS ID (where known). NWIS will de-duplicate these files, combine, and create and apply a number to it. The NHS Wales Information Service will then send these files containing the identifiers to the organisations who own and manage the data, such as the NHS, where they will match the identifiers to the people who are participating in the collaborating studies. The collaborating studies and owners of official records, such as the NHS or the Office for National Statistics, will send the pseudonymised data into the UKSeRP Gateway. UKSeRP will combine de-identified data provided by owners of official records with pseudonymised data provided by the studies using the Key ID. UKSeRP will then create an encrypted Key ID (eKey ID), before the de-identified combined data are stored within the UK LLC. The UK LLC staff have no access to the key which links this UK LLC ID to participant identifiers. This means that only the UK LLC staff (at the University of Bristol) and the IT staff keeping the system safe (at the University of Swansea) have access to all the UK LLC datasets and this is necessary for data management and preparation.
Your biological samples
We gained your permission to collect blood samples from you during the Age 46 survey. We have collected these samples for use in health research, and if you gave us permission, to extract DNA for genetic research. You may have received a letter with the results of analysis of your blood sample including cholesterol and glycated haemoglobin. Your biological samples are shared securely with accredited biobanks and laboratories that store and process your sample on our behalf or for research purposes. For more information, see the FAQ ‘Why did you want to take my DNA?’. Our collection and destruction of these samples is regulated by the Human Tissue Act 2004. Access to sensitive data is managed by the CLS Data Access Committee. Information about how researchers access data from the study is available on the CLS website at ‘Accessing data directly from CLS’.
Your paper questionnaires and forms
Where you, your family or contacts, such as your teacher, have completed paper questionnaires as part of the study, we may store original copies or digital scans of these so that we have a record of you taking part in the study and for research purposes. Original copies are stored securely. Digital copies are held in a secure restricted access UCL database. Some of these original copies were collected by other organisations that managed the cohort before us.
Under the GDPR, where exemptions do not apply and our policies allow, you have the right to tell us:
When you contact us to exercise your rights, we will:
Table 1 summarises the data that we hold about you and who we share this with.
Table 1: Summary of the data that we hold for BCS70 and who we share it with
|Types of data that we hold about you||Controllers||Categories of recipients||Purposes of sharing your data|
|Contact details, personal information and survey answers.||UCL||Mailing and survey agencies||To contact you and keep your record up to date for the purposes of BCS70.|
|Biological samples (blood /DNA)||UCL||Nurse/survey agency
Licenced laboratories Researchers/research organisations Biobanks
|To collect and process your sample for research, statistical and archiving purposes.|
|Research data from the study, surveys (e.g., COVID-19 Survey) including:
– Genetic data linked to survey results
– Data from the data linkage programme (from NHS organisations, government departments, research and statistics organisations, databanks, other data controllers in the private sector).
|UCL (and public sector bodies for specific projects)||Survey agencies
Trusted research data services
|For research, statistics and archiving purposes.|
|Name, sex, postcode, date of birth, address, National Insurance number (if known), NHS number/ID (if known) and study ID (study-specific pseudonymised
Trusted third parties for data linkage Research/statistics organisations
|To add information to your record.
For research purposes.
For contact tracing.
|Legacy data (original questionnaires and consent forms).||UCL||Researchers/research organisations||For archiving and research purposes.|
We may also share your contact details or personal information securely with other organisations, for projects that you have agreed to be part of, including:
CLS, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we have agreements in place to protect your information in accordance with our legal obligations.
CLS research data are governed by the principles and procedures set out in our CLS Research Data Access Framework and CLS Data Classification Policy. If we share information with other organisations, we will put safeguards in place to ensure that your information is secure.
Data is classified and, if necessary, pseudonymised before it is shared securely with researchers. We have people, systems, policies and contracts in place to keep your data secure. UCL has ISO-27001 certification which demonstrates that all efforts are taken to keep your data secure. More information about how we keep your data secure is available at ‘What safeguards do we have in place to protect your personal information?’.
We keep your data for as long as is required for the purposes of the BCS70 longitudinal study and our statutory and legal obligations. Our Records Management Policy and Records Retention Schedule ensure that all CLS records, whether paper, digital, email or audio-visual are managed in line with records management principles. Further information on how long we keep records for is included in our records retention schedule.
This privacy notice is updated regularly and was last updated on 23 April 2021
For more information about how we use your personal data, please see our frequently asked questions.