College of Life Sciences research privacy notice

The College of Life Sciences (CLS) is part of the University of Leicester. The College conducts research activity which has obtained appropriate ethical and legal approvals. Data collected as part of our research activity is processed and stored strictly in the public interest. The College is able to assure compliance by following the UK Policy Framework for Health and Social Care Research.

The information in this privacy notice is intended to supplement specific information provided to data research subjects, for e.g. through participation information sheets or consent forms, with regard to their participation in research projects carried out by the University of Leicester.  

Please note the University of Leicester is the Data Controller for your information.

What information are we collecting and what is the purpose for processing it? 

The type of personal information and the purpose for which is collected will depend on the specific research objectives of the research activity. The detailed information about data collected will be or has already been provided to you through the participation information sheet before you became a research participant.

We may collect information about you directly from you or on some occasions we may collect from third parties such as GPs or hospitals, when you have provided consent. The information collected will be proportionate to achieve the research objectives and our researchers will not collect more information than is actually needed. 

In some instances the information collected may come from other sources and we may not have requested consent if it was not possible or practical to do so. In order to do this the principle investigator of the project will request authorisation from the NHS Health Research Authority’s Confidentiality Advisory Group (CAG) to obtain your personal data from the NHS directly under Section 251 of the NHS Act 2006. 

Section 251 permits the common law duty of confidentiality to be set aside to allow disclosure of confidential patient data for medical purposes, when is not possible to seek consent and anonymization is not possible. 

See more information about the CAG and Section 251.

What is the legal basis for processing the data?

The University of Leicester legal basis upon which we will process your personal information for research activity is public task and this is set out in Article 6 of the GDPR “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”

Please note the official authority to carry out research is expressed in the University’s Charter in section 13 (b).

In addition, our research is carried out in the public interest as results may be used for the advancement, publication and dissemination of the findings of discoveries. 

In some cases research activities may require processing of special category data. Depending on the research activity and the data which will be collected the University may process it under Article 9 paragraph 2(a) which refers to consent as the legal basis or Article 9 paragraph 2 (j) which refers to archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as the legal basis. 

If we are sharing your data with others, who are we sharing it with?

Your information will be accessed by the research team. However, research information tends to be pseudonymised or anonymised, this means all identifiers such as NHS number, name, data of birth etc., are stripped from the records. This is normal practice and usually happens before we share the data or publish research outcomes.  

On some occasions it may be necessary to share your identifiable participant’s personal data with other researchers in order to achieve research objectives. If that is the case, you will be or have been informed of this through the information patient sheet or consent form the research team provided when you joined. If you would like to have further details about how your personal data in shared please contact the research team of the project, trial or study in which you are a participant. 

How long will we process your data for?

Personal data collected for research purposes tends to vary according to the purpose of the specific activity. However, health/medical research data tends to be long term use and storage. 

You will be able to find more specific information about the retention period in the information patient sheet or consent form the research team provided when you joined the project, trial or study in which you are a participant. 

What are your rights and how to enforce them?

As a research participant you have the following individual rights under Data Protection legislation:

• access your personal information – right to access
• correct any inaccurate information – right to rectification
• erase any personal information – right to erasure
• restrict or object to our processing of your information – right to restriction
• move your information (portability) – right to data portability

However, please note that some of these rights may be restricted if the exercise of these may seriously impair research outcomes.

It is also important to understand that these rights will only apply if the research project holds identifiable information about you. Where your information has been completely anonymised this information is no longer accessible and is therefore not classed as personal data for the purposes of the Data Protection Legislation. Therefore the rights specified above apply will no longer apply. 

How to complain to the Information Commissioner’s Office

If you feel the research team in which you are a participant has not handled your personal data appropriately or have any concerns about your personal data, you can complain to our Data Protection Officer, details above. 

Also, you may complain to the Information Commissioner’s Office, commonly known as ICO. 

The Information Commissioner can be contacted:

• Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF
• 0303 123 1113
• ICO website