How your data is used in research
Why does health and care research use your data?
All NHS organisations (including Health & Social Care in Northern Ireland) are expected to participate in and support health and care research. The Health Research Authority and government departments in Northern Ireland, Scotland and Wales set standards for NHS organisations to make sure they protect your privacy and comply with the law when they are involved in research. The NHS research ethics committees review research studies to make sure that the research uses of data about you are in the public interest, and meet ethical standards.
There are lots of different types of health and care research. Research may be sponsored by companies developing new medicines or medical devices, NHS organisations, universities or medical research charities. Research is a way of understanding new things about specific conditions, medications, interventions or ways to support people with their health.
The research sponsor [For GMMSIN this is the University of Salford] decides what information will be collected for the study and how it will be used. All research should only use data about you essential to do the research. Health and care research should also serve the public interest. This means that research sponsors have to show that their research serves the interests of society as a whole. This is a requirement of law and the UK Policy Framework for Health and Social Care Research.
When you have agreed to take part in a study you may complete questionnaires or interviews. The research team will record this data in special forms and combine it with the information from everyone else in the study. This recorded information is called ‘research data’.
How does research use your data?
If you take part in some types of research, some of the research team will need to know your name and contact details so they can contact you to arrange an interview or to link questionnaires you complete at different times together. Researchers must always make sure that this information can only be seen by those who absolutely need to contact you or to complete the task it is required for.
In lots of research, the research team will not need to know your name. In these cases, once you name or identifying details (e.g., date of birth or email) are no longer needed for practical reasons someone will remove your name and any other information that could show who you are, from the research data and replace it with a code number. This is called ‘coded data’. For example, your blood test might be labelled with your code number instead of your name. It can be matched up with the rest of the data relating to you by the code number.
When you agree to take part in a research study, the research team will collect the minimum information that can identify you needed to do the research project. This information will only be used in the ways needed to conduct and analyse the research study.
Where will your data go?
You can always ask about where your data will go. In this study your data will stay in the UK. You can also check whether the data they get will include information that could show who you are.
Your research data may also be seen by professionals who check the quality of the research. Sometimes regulators might need to check the research.
All the computers storing your data must meet special security arrangements.
What does the research team do with your research data when the study completes?
Researchers must make sure they write the reports about the study in a way that no-one who reads them can work out that you took part in the study.
Once they have finished the study, the research team will keep the research data for several years in case they need to check it. You can ask about who will keep it, why they keep it, whether it includes your name and other information that identifies you, and how long they will keep it.
The sponsor running the research will usually only need to keep a coded copy of your research data, without your name included. This is kept so the results can be checked.
Keeping your data for future research
Research data may be used in future research, in which case it must be stored securely until that time and always with strict limits on who can access it. Your data will not be used to sell you anything. It will not be given to other organisations or companies.
Will the use of your data meet UK GDPR rules?
GDPR stands for the General Data Protection Regulation. In the UK we follow data protection law rules set out in the UK GDPR and the Data Protection Act (2018). All research using your personal data (information that identifies you as a living person) must follow these rules, including research.
Universities, NHS organisations and companies may use your data to do research to make health and care better, but they must have a legal basis under UK GDPR to use personal data.
When companies and charities do research to develop new treatments or deliver better healthcare, they need to be able to prove that they need to use your data for the research, and that they need to do the research to develop new treatments or deliver better healthcare. In legal terms this means that they have a ‘legitimate interest’ in using your data.
UK universities and the NHS are funded from taxes and they are expected to do research as part of their job. They still need to be able to prove that they need to use your data for the research. In legal terms this means that they use your data as part of ‘a task in the public interest’.
If they could do the research without using your data they would not be allowed to see or use it.
Who can you contact if you have a complaint?
If you want to complain about how researchers have handled your information, you should contact the research team. If you are not happy after that, you can contact the Data Protection Officer. The research team can give you details of the right Data Protection Officer.
If you are not happy with their response or believe they are processing your data in a way that is not right or lawful, you can complain to the Information Commissioner’s Office (ICO) +44 (0) 303 123 1113.