Human Tissue Bank privacy notice

The College of Life Sciences (CLS) is part of the University of Leicester. The College conducts research activity which has obtained appropriate ethical and legal approvals. Data collected as part of our research activity is processed and stored strictly in the public interest. The College is able to assure compliance by following the UK Policy Framework for Health and Social Care Research.

The Leicester Human Tissue Bank is a part of the University of Leicester.

The purpose of this privacy notice is to explain to you, our participants, how we collect share and use the personal information we collects about you.

When you are invited to take part in a trial, you will be provided with a document called a patient information sheet which is an ethically approved document which provides information about the information collection process. It will also explain if other organisations are involved in the trial and what their roles are.

We have a specific responsibility to ensure that human tissue samples are collected, stored and managed as required by the Human Tissue Act.

We will be using information from you and your medical records in order to ensure that all samples obtained from you are used only in ways for which you have given valid consent, and that any restrictions you have placed are recorded and respected.

We will also be using such information to describe the samples in ways to maximise their usefulness to researchers.

Please note the University of Leicester is the Data Controller for your information.

What information are we collecting and what is the purpose for processing it?

When providing high quality tissue and blood sampling, we will ask for information about you, such as your name, address, DOB, health care number etc. this is known as your “Personal Data”.

We will also take some special categories of information (for example biometric and health related data). This is known as your “Sensitive Personal Data”.

All research trials are different and the information we collect will vary. However, researchers will only collect information that is essential for the purpose of the research.

Information we may collect from you

• Name, date of birth, NHS Number or some other identifiers;
• GP/Consultant/Hospital name and contact details;
• Your contact details, if you are a potential participant, who has asked to be kept informed about the trial, electronically. These details will be deleted when they are no longer needed;
• During the trial, we will collect information about you from other sources, which will include medical information relevant to the trial and/or your medical records.

Other sources we may collect information from

We may collect information from 3rd party providers such as clinical and pathological data from sources within the NHS and NHS Clinicians.

Information relating to the deceased

It is a requirement under the Human Tissue Act that consent must be in place to store and use bodies of the deceased, or to remove, store, and use tissue from the body of a deceased person. Where we are using this information, we will collect consent from the next of kin of the deceased.

What is the legal basis for processing the data?

The University of Leicester legal basis upon which we will process your personal information for research activity is public task and this is set out in Article 6 of the GDPR “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

Please note the official authority to carry out research is expressed in the University’s Charter in section 13 (b).

In addition, our research is carried out in the public interest as results may be used for the advancement, publication and dissemination of the findings of discoveries.

Special category data collected by the University may be processed under Article 9 paragraph 2(a) which refers to consent as the legal basis or Article 9 paragraph 2 (j) which refers to archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as the legal basis.

We will only use your Personal Data if we have valid reasons for doing so.

If we are sharing your data with others, who are we sharing it with?

Individuals from the University of Leicester and regulatory organisations may look at your medical and research records to ensure that the process of obtaining your consent and handling your data, including any samples, is fully compliant with GDPR (EU) 2016/679, Data Protection Act and Human Tissue Act requirements.

The only people in the University of Leicester who will have access to information that identifies you will be people who need to contact you to follow up or audit the data collection process.

When you agree to the use of samples for research purposes, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations.

These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad.

Anonymised samples or research data may be shared with healthcare professionals who contribute to the research, or with organisations and researchers in accordance with the UK Policy Framework for Health and Social Care Research.

Anyone requesting access to samples you have provided, and information about them, will not be able to identify you, nor find out your name or contact details.

We will only share data or samples outside of the University where there is an agreement in place and when the relevant regulators are satisfied that there are appropriate safeguards in place to conduct the safe transfer and storage.

Outside of the data sharing requirements described above, we do not share personal data or samples with any other third party without the express permission of the data subject or as permitted by data protection law.

How long will we process your data for?

Patient consent forms

Patient consent forms will be kept for the duration of a research project, or while the samples are in existence, and may be archived after if required for important future medical research. The consent forms could be either paper copies or electronic versions.

Samples

We will keep your sensitive personal data indefinitely from the date of collection of the sample. However, personally identifiable data will be pseudonymised.

The University will keep sufficient identifiable information about you to demonstrate that your sample has been obtained and used only in ways to which you have agreed for as long as is required by the Human Tissue Act.

The length of time for which we keep your data will depend on a number of factors including the importance of the data, the funding requirements, the nature of the study, and the requirements of the publisher. Details will be given in the information sheet for each project.

In the event that the University of Leicester Human Tissue Bank ceases to exist, all information, including your samples will be kept for a minimum period of 5 years or until the next Human Tissue Authority inspection whichever is the greater timescale, after which time it will be destroyed by a disposal procedure which conforms to Human Tissue Authority licensing requirements.

What are your rights and how to enforce them?

Where samples are held under public task, you have the following individual rights under Data Protection legislation:

• access your personal information – right to access
• correct any inaccurate information – right to rectification
• erase any personal information – right to erasure
• restrict or object to our processing of your information – right to restriction
• move your information (portability) – right to data portability

Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order to demonstrate that your samples have been collected and used only in ways to which you have consented.

Where your information has been completely anonymised this information is no longer accessible and is therefore not classed as personal data for the purposes of the Data Protection Legislation. Therefore the rights specified above apply will no longer apply.

To safeguard your rights, we will use the minimum personally identifiable information possible. Please note we will always try to respond to concerns or queries that you may have about your rights, if you require further information please contact us.

How to complain to the Information Commissioner’s Office

If you feel the research team in which you are a participant has not handled your personal data appropriately or have any concerns about your personal data, you can complain first to our Data Protection Officer, details below.

Parmjit Singh Gill, Data Protection Officer, University Of Leicester, University Road, Leicester, LE1 7RH, dpo@leicester.ac.uk. You also have the right to complain about how we treat your Personal Data and Sensitive Personal Data to the Information Commissioner’s Office (ICO). The ICO can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF