This privacy notice explains your rights to your personal information, what you can expect us (the Cancer Screening and Prevention Research Group) to do with your personal data and our lawful basis for doing so. This notice also explains who you should contact if you have any queries or complaints about how we are processing your personal data.
Under the 2018 General Data Protection Regulation (GDPR) and accompanying Data Protection Act (2018) ‘personal data’ is any data that can be linked to an identifiable individual (for a full definition see: Information Commissioner’s Office (ICO) website: What is Personal Data?). Some types of personal data, such as health data, are additionally classified as ‘special category personal data’. The law considers special category personal data to be more sensitive and gives it more legal protection (for more information see: ICO website: Special Category Data). As the Cancer Screening and Prevention Research Group processes (processing is the term used to refer to collecting, analysing and storing data) health data, much of the personal data we hold is considered to be special category personal data.
Who is responsible for the lawful processing of your personal data?
The GDPR and Data Protection Act define roles and responsibilities for those involved in processing personal data.
The Cancer Screening and Prevention Research Group (hereafter; CSPRG) are a research group at Imperial College London. The CSPRG can be contacted via the ‘Contact Us’ page on this website. The data controller determines the purpose for which and the manner in which personal data is to be processed see ICO website: Controllers and Processors. For the personal data held by the CSPRG, the data controller is Imperial College London. The data controller’s representative for our data is the Director of Information Governance for Academic Health Sciences. All queries relating to the handling of personal data should be directed to the Imperial College London Data Protection Officer via email at email@example.com. Contact details can also be found at the end of this privacy notice.
Why are we processing personal data?
The research focus of the CSPRG is bowel cancer, also known as colorectal cancer. In the UK, every year over 41,000 people are diagnosed with bowel cancer and 16,000 people die from this disease. Through our research we hope to reduce the number of people being diagnosed with bowel cancer and dying from this disease. Much of our work focuses on how to help make bowel cancer screening and surveillance programmes more effective and acceptable for patients, and more efficient for the NHS, and other health services internationally. To understand the effectiveness of bowel cancer screening and surveillance programmes, we conduct large scale studies on procedures conducted and the benefits to patients. Identifiable patient data are usually necessary to track long-term health outcomes from participants enrolled in our studies. The CSPRG therefore needs to collect and hold personal data – often special category personal data. Our more specific purposes for processing data for each of our studies are detailed on the ‘Studies’ pages of our website.
What personal data do we have?
The personal data we hold is special category personal data relating to individual health. For example, for several of our studies we analyse procedure and treatment information, information about cancers occurring, whether they progress and the patients’ long-term health outcomes. In addition, we also often require some basic information about patients such as age and gender to inform our analysis. The full details of the personal data processed for each of our studies can be found on the ‘Studies’ pages of our website.
To fulfil our research aims we obtain personal data from a variety of sources. Much of our data is either obtained directly from NHS Trusts, or via third parties such as NHS Digital, the Office for National Statistics, the Bowel Cancer Screening Programme, National Cancer Registries (including the Welsh Cancer Intelligence and Surveillance Unit) and Information Services Division Scotland, part of NHS National Services Scotland. More detailed explanations of our sources of data can be found on the ‘Patient Data’ page and ‘Studies’ pages of our website.
Where data has been obtained from third party data providers under section 251 approval, national data opt-outs have been applied by the provider since 2016.
How do we process personal data?
All personal data we hold are processed in secure systems. For each active study we have completed a Data Protection Impact Assessment that has been approved by the Head of the CSPRG (as the Information Asset Owner) and the Imperial College London Data Protection Officer. No processing performed by the CSPRG involves automated decision-making or profiling. Unless stated otherwise on the ‘Studies’ pages of our website, all personal data are processed exclusively by the CSPRG. None of our studies process or transfer personal data outside the UK.
The Imperial College Data retention schedule mandates that data is retained for ten years after the end of a study (see the College Retention Schedule here). The expected end of these ten year retention periods for each of our studies are listed under the ‘Studies’ pages of our website under the ‘How long will we retain the data?’ sections.
What is our lawful basis for processing personal data?
Processing personal data requires justification under two legal frameworks: the GDPR/Data Protection Act 2018 and under the common law duty of confidentiality.
Article 6 of the GDPR lays out six valid bases under which personal data can be processed lawfully. We process personal data under lawful basis 6(e) ‘Public task’ as: processing is necessary for the performance of a task carried out in the public interest. We are also required to have a separate lawful basis for processing the more sensitive special category personal data. Our legal basis for processing special category personal data is Article 9(j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes […]’
In addition, health data (such as that the CSPRG hold) require a separate lawful basis under the common law duty of confidentiality. In some of our studies, patients consented to be part of the study and for the CSPRG to process their data. In other studies, consent could not be sought due to practical considerations or the nature of the study. In these studies, we have obtained lawful permission to obtain and process personal data under section 251 of the National Health Act 2006. The common law legal bases for data processing in each study are explained in the ‘Studies’ pages of our website under the ‘What approvals has the study received?’ sections.
What are your rights concerning your personal data?
The GDPR grants individuals several rights concerning their personal data:
- The right to object (to processing of the data)
- The right to correct (inaccurate or incomplete data)
- The right to erasure (also known as “the right to be forgotten”)
- The right to restrict processing (e.g. while the accuracy of the data is contested)
- The right to portability (to have a copy of any data you have provided to us)
- The right to access (to have a copy of data we hold about you)
- The right to withdraw consent (if you have previously consented to take part)
If you think that we might be processing your data and you wish to exercise any of the rights listed above, please get in touch using the details on the Contact Us page or by contacting the Imperial College London Data Protection Officer via email at firstname.lastname@example.org. Though it may not always be possible for us to fulfil your request, we will respond to your query within one month. For more information on your GDPR rights, please see guidance provided by the Information Commissioner’s Office.
Where can you direct queries or complaints?
Please be aware that individuals also have a right to complain to a supervisory authority- in this case the Information Commissioner’s Office (ICO) – if they feel their data is being used unlawfully. The ICO does recommend that you seek to resolve matters with the data controller – for our data that is Imperial College London – before contacting the commissioner’s office. If you wish to raise a complaint on how we have handled your personal data or if you want to find out more about how we use your data, please contact Imperial College London’s Data Protection Officer via email at email@example.com, via telephone on 020 7594 3502 or via post at Data Protection Officer, Faculty Building Level 4, Imperial College London, London SW7 2AZ. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can raise your complaint with the Information Commissioner’s Office.
Privacy and data protection information relating specifically to the Intermediate Adenomas and All Adenomas studies
The CSPRG at Imperial College London processes special category personal data for the IA and AA studies. The purpose of these studies is to examine the UK adenoma surveillance guidelines. To do this, we are monitoring the long-term outcomes of patients classified at low-, intermediate- and high-risk of colorectal cancer after endoscopy. A patient’s surveillance regime is based on their risk classification. Long-term special category personal data are needed to assess the efficacy, cost-effectiveness and outcomes of surveillance regimes in the different risk categories. This information will be used to generate evidence to support an update of the adenoma surveillance guidelines and to investigate the potential cost implications to the NHS (see ‘What are the aims of the IA and AA studies?’ below). The special category personal data used in this study is crucial to the success of this project, and the public good generally.
Imperial College London (the data controller for data processed by the CSPRG, see above) are the recipient of data for the IA and AA projects. The special category personal data for the IA and AA studies is received by the CSPRG from several sources.
1. Hospital trusts in England and Scotland
The CSPRG receive clinical data – such as the results of endoscopies –from 17 participating hospitals in England and Scotland. The 17 participating hospitals were:
- Royal Sussex County Hospital
- St Mark’s Hospital
- Glasgow Royal Infirmary
- Charing Cross/Hammersmith Hospital
- St Mary’s Hospital
- Cumberland Infirmary
- Queen Elizabeth Hospital
- Queen Mary’s Hospital
- Royal Liverpool University Hospital
- Royal Surrey County Hospital
- New Cross Hospital
- Royal Shrewsbury Hospital
- Torbay District General Hospital
- St George’s Hospital
- University Hospital of North Tees
- Leicester General Hospital
- Yeovil District Hospital
NHS Digital collect and process data from across the health and social care system in England. For patients in England we receive cancer incidence and mortality data from NHS Digital. NHS Digital also receive cause of death data for patients in England from the Office for National Statistics which is passed on to the CSPRG.
The Office for National Statistics provide cause of death data for patients in England to the CSPRG via NHS Digital.
Cancer staging data for patients in England are provided to the CSPRG by Public Health England.
For patients in Scotland, cancer incidence and mortality data, cause of death data and cancer staging data are provided to the CSPRG by NHS National Services Scotland.
For patients from England who move to Scotland during the course of the study, cancer staging data are provided to the CSPRG by the NHS Central Register.
All data we receive from these data providers is pseudonymised. Pseudonymised data (see also GDPR Article 4.3) are personal data that can no longer be attributed to a specific individual without additional information because easily identifiable identifiers – such as names and NHS numbers – have been removed from the data before it is received by the CSPRG. This means the CSPRG cannot link the data we have received to other personal or special category personal data.
A subset of the AA study data has been sent to our collaborators at the Health Economics Research Centre at the University of Oxford, so that they can conduct a health economics analysis. Imperial College remain the data owners of this data subset and the University of Oxford act as Data Processors. At the end of their part in the study, the University of Oxford will delete their copies of the data. This data processing is covered by Data Sharing Agreements between Imperial College London and the University of Oxford.