BASIL-2 Privacy Notice

This privacy notice explains how BASIL-2 study uses and processes the personal data collected from the study participants.  It supplements the privacy notice of the University of Birmingham and  the Birmingham Clinical Trials Unit's Data Sharing Policy.

 

Who we are?

BASIL-2 study is centrally managed and coordinated by the Birmingham Clinical Trials Unit (BCTU).  The BCTU is a part of the University of Birmingham and has a long-term tracked record in designing, managing and analysing clinical studies. 

The study is led by Andrew Bradbury, Sampson Gamgee Professor of Vascular Surgery.  BASIL-2 is funded by the Health Technology Assessment, NIHR (project application number 12/35/45) and sponsored by the University of Birmingham (sponsor reference RG_14-030).  The study was reviewed and approved by the NRES committee West Midlands – Coventry and Warwickshire (REC ref: 14WM0057).

Contact

University of Birmingham (UoB)
Edgbaston
Birmingham
B152TT
United Kingdom
Main Switchboard:
Tel: +44(0)121 414 3344
Birmingham Clinical Trials Unit (BCTU)
Institute of Applied Health Research
College of Medical and Dental Sciences
Public Health Building
University of Birmingham
Edgbaston
Birmingham
B15 2TT
Telephone: +44 (0)121 415 9100
Fax: +44 (0)121 415 9135/136
Email: bctu@contacts.bham.ac.uk

 

Processing of personal data

Here we explain what personal data is, how we manage it and which personal data will collect on the study participants. 

Legal basis for processing personal information about study participants:

Any information we hold about the study participants is processed for the purposes of ‘the performance of a task carried out in the public interest’ (the Article 6(1)(e)) of the Data Protection Act 2018, and ‘scientific research’ (the Article 9(2)(j)) of the Data Protection Act 2018.

The EU General Data Protection 2016/679 (GDPR) came into regulation from 25 May 2018, which was thereafter supplemented by the DPA 2018.  The DPA 1998 covers how personal data may be lawfully processed (collected, used and shared).  This is referred as a “data protection law”.  The data protection law regulates how we process participants “personal data”.  The University of Birmingham determines the purpose and means of data processing, i.e. acts as a “data controller”.  

What is personal data?

Personal ‘data’ is information that relates to an identified or identifiable individual.  It does not include information relating to dead people, groups or communities of people, organisations or businesses.  Nonetheless, the BASIL-2 study team will ensure that we will continue to keep information confidential, safe and secure after the death of any individual taking part in the study.

What is data processing?

“Data processing” is any operation performed on the data such as collection, use, management or disclosure.

What personal data will be processed?

The information we collect on the study participant may include and not limited to:

  • Name, date of birth, NHS number and some other identifiers, i.e. hospital number;
  • GP/hospital name and contact details;
  • Medical information relevant to the study:
  • participant contact details (these details will be deleted when they are no longer needed).

During the study we will process further details on participants.  This may include:

  • Details about participation in the study:
  • Outcomes of any procedures, tests, questionnaire undertaken as part of the study.

How we manage personal information?

The Data Protection Act 2018 (DPA 2018) regulates the management of personal information.  This is how we look after personal information on study participants.  When we ask participant’s personal information we:

  • make sure that the participant knows why it’s needed;

  • ask only minimum and sufficient information that is required and do not collect too much or irrelevant information;

  • protect it and make sure no unauthorised person has access to it;

  • let participant you know if we share it with other organisations, which is necessary to improve public services;

  • let participant know that they can withdraw at any time from the study;

  • do not keep it for longer than it is necessary;

  • inform participants that they can withdraw from the study any time;

  • Give contact details of a person/department/body where to direct enquires or complaints. 

Patients receive an ethically approved Patient Information Sheet (PIS) upon invitation to take part in the trial.  The PIS will detail information about the study, how patient information will be collected and handled and where it would be collected from.  The PIS will also explain what their involvement would be.  In addition, the document will explain if other organisations will be involved in the study and what their roles are.

Potential participants will be given plenty of opportunity to ask the study related questions to a member of the research team.  In return we ask participants to:

  • give us accurate information;

  • tell us as soon as possible if there are any changes to their personal circumstances such as contact details to enable to keep the information reliable and up-to-date.

The purpose of processing

We collect participants’ personal and healthcare data in order to answer the study question.  Collecting personal information is necessary for traceability and collection of further data. 

 The target population of BASIL-2 trial is people with severe limb ischaemia.  The data will be collected directly from the trial participants, medical records and/or from NHS agencies.  The data will be directly relevant to answer trial specific question: the trial explores and compares clinical effectiveness of angioplasty/stenting and bypass surgery in treating severe limb ischaemia due to blocked infra-popliteal artery.  It also explores pros and cons of both treatments in terms of success and safety.  In addition, the trial will compare cost effectives of both procedures.  More information about the study can be found on BASIL-2 trial web page.  

Where do we collect the data from?

The data will be normally collected either directly from participants or from medical records from the hospitals or GP practices and healthcare agencies such as NHS digital.

To safeguard participants’ rights, we collect the minimum personally-identifiable information possible.

Some of the data we process is classed as ‘special category’ or sensitive personal data. This data may include information concerning health, racial or ethnic origin. 

Methods of obtaining data

Data will be obtained directly from the trial participants, medical notes from hospitals or GP practices, from the Health and Social Care Information centre, NHS digital and other current and future NHS bodies (e.g. NHS Digital). 

We will not use automated processing of participant’s personal data at any stage of data processing.

Data from NHS Digital

Data from NHS Digital is designed to enable other non-clinical uses, such as researchers to obtain aspects of NHS care.  

The NHS Digital will provide the information to BASIL-2 researchers about date of death, cause of death and amputation data of any BASIL-2 participants who consented to participate in the study and specifically allowed member of the BASIL-2 study to obtain data from NHS digital.

The data supplied by NHS Digital will contain sufficient information to ensure that the information is assigned to the correct patient record on the database.  Once imported into the non-backed up location/database the information will be linked to the study fields.  The information obtained will be modified to ensure that participants cannot be identified by non-study members of the University.

The University of Birmingham is subject to strict contractual standards imposed by NHS Digital, as the data provider. These include storing the data provided by NHS Digital on an encrypted drive connected to a separate and dedicated server, access to which is restricted.

As contractually required, data supplied by the NHS Digital will not be kept for longer than required.  The data will be stored on a non-backed-up location which will then be destroyed as requested by the NHS digital.

The data from NHS Digital will be supplied to the University of Birmingham, BCTU (contact details as above).  

Data from GP records

Data may also be collected from the UK General Practices.  This may include date of death, cause of death, and amputation details if available.

Data from hospitals

Data may be collected from hospitals and may include medical information related to the study, date of death, cause of death, and amputation details if available.

 

What will we do with the data obtained?

The data supplied by the NHS Digital will be matched up with  BASIL-2 participants’ trial numbers outside of the trial database on a non-backed up location and will then be deleted as agreed contractually.  The data will be combined with other information before the dataset is anonymised.  The study statisticians will then analyse the data according to the statistical analysis plan.  The aggregate data will be published in NIHR Journals Library and other publications and disseminated among professionals.  Primarily, the study participants will be informed about the results of the study.

With whom will we share the data?

The BASIL-2 study involves many organisations such as hospitals recruiting participants, GP practices, the sponsor, oversight committees and study management group, as well as national registries such as NHS digital.  For the purposes of assessment and analysis of the study data or safety issues it may become necessary to share participants identifiable (e.g. date of birth) and healthcare information with these organisations during the study. 

The study team at the sites (hospitals) or authorised personnel from the sponsor and other regulatory bodies may look at the participants medical records.  This is necessary to ensure that the study is being conducted and managed to the highest possible standards.

Participant information may be occasionally shared with researchers of other ethically approved studies.  They may be based at the University of Birmingham, or any other universities, NHS organisations or companies involved in healthcare research in the UK, Europe or elsewhere.  The access to information will be strictly controlled and anonymised before being shared.  Participants will not be identified in any way in any report, presentation or publication arising from this data sharing agreement.  The study team will ensure that appropriate safeguards are in place to protect the confidentiality and security of the participants’ data.

On some occasions, the study may be inspected by a third party organisations to make sure that the study is conducted in accordance with relevant requirement and legislations.  This may for example include NHS digital or the Information Commissioner’s Office.  In such circumstances data sharing becomes necessary to meet legal and regulatory requirements and is only for the purposes of the audit.

How long will the data be kept?

The information collected on the study participants will be kept within the BCTU and the hospital minimum of 5 years after the completion of the study.

Participant’s rights in relation to their data

The details on participants rights can be found on ‘Data protection – How the University Uses your Data’ 

What happens if participants change their mind?

During the course of the study participants may change their mind their data being included in the BASIL-2 study analysis.  The inclusion of their data is entirely up to the participant and choosing to do so will not disadvantage them in any way.  However, because the study is being conducted as a ‘task in the public interest’ and ‘scientific research’ according to the data protection law, participant’s right to change or remove information may be limited.  This is because we need to process information in such ways that the research we carry out is at the highest standard, reliable, accurate and verifiable.  This means that we will keep the data that has already been obtained before participant’s withdrawal from the study.

"Rights to be forgotten"

Under the article 17 of GDPR the study participants have right to request “right to be forgotten” (aka “the erasure”) of their personal data without undue delay.  The trial subjects can request this verbally or in writing.  We have the obligation to erase the personal data without undue delay and will respond to this request typically within one month.  

 

BASIL-2 data protection

When we ask you for information we will keep to the law, including the Data Protection Act 1998. Through appropriate management and strict controls, we will follow the 8 principles of data protection described in the act. Also see the Information Commissioners general guidance on the implementation of data protection.

We will also ensure that:

  • there is someone with specific responsibility for data protection in the organisation (the nominated person is called the Data Protection Coordinator)

  • everyone managing and handling personal information understands that they are contractually responsible for following good data protection practice, is appropriately trained to do so and is appropriately supervised

  • we deal with enquiries about how we handle personal information promptly and courteously

  • we describe how we handle personal information clearly, regularly review and audit how we manage personal information, and regularly assess and evaluate methods of handling personal information

    Find out more about how we deal with personal information

    Details of how we use personal data are set out in the Information Commissioner’s Register of Data Controllers.

Contacts regarding personal data

Who to contact for enquiries about personal data?

In case or concerns or questions related to personal data please contact the BASIL-2 trials office directly.  If the issue has not been resolved contact the University Data Protection Officer in writing or via email:

 The Information Compliance Manager

Legal Services
University of Birmingham
Edgbaston
Birmingham
B15 2TT
Or by email: dataprotection@contacts.bham.ac.uk

Making a complaint

When we ask you for personal information we will handle it in accordance with the law. If you consider that your information has been handled incorrectly you can contact the Information Commissioner for independent advice about data protection, privacy and data sharing issues. You can contact the Information Commissioner at:

 

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545 745
Fax: 01625 524 510
Website: www.ico.gov.uk