Early Breast Cancer Trialists’ Collaborative Group Overview Privacy Notice
What is the purpose of this document?
The University of Oxford is committed to protecting the privacy and security of personal information (‘personal data’). This privacy notice describes how we collect and use personal data for the Early Breast Cancer Trialists’ Collaborative Group (EBCTCG) overview, in accordance with the UK General Data Protection Regulation (UK GDPR).
Glossary
Where we refer in this privacy notice to ‘personal data’, we mean any recorded information that is held about a person, who was either recruited into a randomised trial for the treatment of breast cancer from which she can be identified or whose correspondence details appear in the EBCTCG contacts list, for the purposes of the EBCTCG collaborative effort. It does not include data where identity has been removed (anonymous data). Where we refer to the ‘processing’ of personal data, we mean anything that we do with that information, including collection, use, storage, disclosure or retention.
Who is using these personal data?
The University of Oxford (legal title: the Chancellor, Masters and Scholars of the University of Oxford) is the ‘data controller’ for the information that we obtain for the EBCTCG overview. This means that we decide how to use the data and are responsible for looking after it in accordance with the UK GDPR. Access to these personal data will be provided to designated members of our staff who need to view it as part of their work.
The types of data we hold and how we obtained it
1. Individual patient data
We collect the majority of the information from the researchers responsible for the trials that recruited the women whose personal data we hold. For some women, further information is added to this from third parties, such as NHS Digital. Please see the CTSU clinical trial follow-up service privacy notice for more details regarding these trials. This information includes special category sensitive data concerning the woman’s health in relation to her breast cancer.
2. Collaborative group correspondence details
We collect information required to identify and correspond with the researchers and data contacts involved in the trials included in the EBCTCG project, and we maintain a database of individuals who wish to receive mailings from EBCTCG.
How the University uses these data
We collect and process personal data (including special category sensitive data) in this way for the purpose of performing scientific (medical) research being carried out in the public interest. This allows us to identify the comparative effects of different treatments for women with breast cancer. This is our legal basis for processing personal data. We will only process personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. We may process data without the knowledge or consent of the person, in compliance with the above rules, where this is required or permitted by law. In particular, we do not contact the individual woman for whom we hold data because of the disproportionate effort required to do so. The University of Oxford Policy on Data Protection can be accessed here: https://compliance.admin.ox.ac.uk/data-protection-policy.
Who has access to these data?
Access to these personal data within the University is provided to those who need to view it as part of their work in carrying out the purposes described above. In addition, in order to perform our research and other legal responsibilities or purposes, we will, from time to time, need to share the information with the following:
- research organisations in the EBCTCG, for example those working with us on analyses of de-identified trial data, or those who legitimately require contact details of other researchers in the collaborative effort;
- external organisations who provide us with the trial data; and
- external regulatory bodies.
Any patient identifiable personal data is held separately from the clinical trial medical data, on a separate, secure area, with named-person access only, and the record is de-identified when incorporated into the main dataset
Where information is shared with third parties, we will seek to share the minimum amount necessary, including anonymising data where possible. All third-parties with whom data are shared are required to take appropriate security measures to protect these data in line with our policies. We permit them to process these data only for specified purposes and in accordance with our instructions.
Transfer of data outside of the UK
The data are stored on our secure servers and/or in our premises within the UK. There may be occasions when we transfer the data outside the UK, for example, to a researcher who is collaborating with us for the purpose of our research. Such transfers will only take place if one of the following applies:
- the country receiving the data is considered by the UK to provide an adequate level of data protection; and
- the transfer is governed by approved contractual clauses.
Retention period
The EBCTCG overview is a long-term study, still under active follow-up. We hope to continue follow-up for as long as possible, and we will retain the personal data for as long as we need it to meet our purposes, including our medical research and any relating to legal, accounting, or reporting requirements.
Security
Data will be held securely in accordance with the University’s policies and procedures. Further information is available on the University’s Information Security website: www.infosec.ox.ac.uk.
Your rights
Under certain circumstances, by law, individuals whose personal data we hold have certain rights with respect to their data. A summary of these rights is available here: https://compliance.admin.ox.ac.uk/individual-rights. If someone wants to exercise any of their rights described or are dissatisfied with the way we have used their information, they can contact the University’s Information Compliance Team at data.protection@admin.ox.ac.uk. The same address can be used to contact the University’s Data Protection Officer. If they remain dissatisfied, they have the right to lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time.
Contact
Anyone wishing to raise any queries or concerns about this privacy notice can contact us at bc.overview@ndph.ox.ac.uk or write to Professor Robert Hills, EBCTCG Secretariat, Clinical Trial Service Unit (CTSU), Nuffield Department of Population Health, Richard Doll Building, Old Road Campus, Oxford OX3 7LF, UK.