Privacy

CCP-UK Privacy Notice

What is CCP-UK?

CCP-UK is a research study involving people with infections. The aims of the CCP-UK study include gaining important information about infections which are of public health interest, and finding better ways to manage and treat these infections in the future.

CCP-UK has been classified as an Urgent Public Health Research study by the Department of Health and Social Care (DHSC).

CCP-UK collects medical information about patients from NHS Trusts across the UK. This data will be used for the purposes of the CCP-UK study, which has received full approval from a research Ethics Committee (13/SC/0149, Oxford C Research Ethics Committee). The CCP-UK data will be stored indefinitely, because it will be of considerable importance to future generations facing similar outbreaks of infectious diseases.

The CCP-UK study is made up of three tiers:

  • Tier 0 – data collection only

  • Tiers 1 and 2 – data collection and human tissue sample collection.

Data is collected from NHS Trusts across the UK and transferred to authorised members of the CCP-UK research team, which includes staff from the University of Oxford, the University of Liverpool, The University of Edinburgh, Imperial College London and Public Health England. Samples are collected from NHS Trusts and transferred to the Outbreak Laboratory at the University of Liverpool, Imperial College London, Public Health England or the Roslin Institute at the University of Edinburgh. Personal data accompanies each sample.

Patients in Tiers 1 and 2 will have consented to the CCP-UK study and received a detailed information sheet when they were in hospital. Patients in Tier 0 did not provide consent and no information on the study has been provided to them – this was not needed at the time of initial data collection, as this data was fully anonymous. A copy of the current CCP-UK Patient Information Sheet is available to view here.

With the recent emergency of the COVID-19 pandemic, CCP-UK is making changes to what data is being collected and the way the data is being used.

Additional data is now being collected, including NHS Numbers (CHI number in Scotland) and postcode. The purpose of collecting NHS numbers is two-fold:

1) NHS Digital data to be used in the CCP-UK study – NHS numbers and other direct identifiers such as postcode will be transferred by the CCP-UK research team to NHS Digital in order to submit a data application request. NHS Digital will use these direct identifiers to prepare a medical dataset. NHS Digital will then strip out all direct identifiers, and provide this to the CCP-UK research team.

2) Data sharing with other research projects looking at COVID-19 – These research projects will be linked to the CCP-UK study, but have their own approvals in place. Details on those projects can be found here.

Due to the collection of NHS numbers, the data for Tier 0 patients is now identifiable.

How does The University of Oxford use and protect my data?

Research is a task that we perform in the public interest. The University of Oxford, as sponsor, is the data controller. This means that we, as University of Oxford researchers, are responsible for looking after your information and using it properly. We will use the minimum personally-identifiable information possible.

The legal basis for the processing and storage of personal data for [study] is that it is ‘a task in the public interest’ (article 6(1)(e)) and, that sensitive personal data is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (article 9 (2) (j), based on Article 89(1)).

Participants in England and Wales:

We will send your unique study number, NHS number, date of birth, postcode and gender to NHS Digital or its successor NHSx. This allows them to retrieve data from routine records about your hospital visits and care, which they will then return to us. The data that we receive back and analyse will be identified by a study number only, and will not be identified by name, date of birth, NHS number or address. The information received from NHS Digital or NHSx will be imported into an intermediate database held by Arden and GEM Commissioning Support Unit (CSU) in a secure environment called a Safe Haven. Before retrieving data from the Safe Haven for analysing with the study data, all personal identifiers will be removed. Importantly, whilst the information received is specific to each trial participant, no individual person will be identifiable in any publication arising from this work. Your personal data will not be shared with any 3rd parties outside of the CCP-UK trial team and will not be used for any automated decision making or profiling. If you would like to have this data withdrawn, please contact the study team using the details given below.

Consent is not needed to obtain and use this extra data as described above, because on 20th March 2020, the DHSC issued notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 (COPI Reg 3(4) for short). This COPI Reg 3(4) notice requires confidential information to be processed and disseminated for COVID-19 purposes only, and expires on 30th September 2020.

If the COPI Reg 3(4) notice is not extended past 30th September 2020, CCP-UK will submit an application to the Confidentiality Advisory Group (CAG) for a Section 251 approval. If this is approved, processing and dissemination of confidential information will continue. The current COPI covers data from participants recruited in England and Wales only.

Participants in Scotland:

We will send your unique study number, CHI number, date of birth, postcode and gender to NHS Scotland. This allows them to retrieve data from routine records (held by NHS Scotland, Public Health Scotland, GPs and National Records of Scotland) about your hospital visits and care, which they will then return to us. The data that we receive back and analyse will be identified by a study number only, and will not be identified by name, date of birth, CHI number or address. The information received from these data sources will be imported into an intermediate database held by Arden and GEM Commissioning Support Unit (CSU) in a secure environment called a Safe Haven. Before retrieving data from the Safe Haven for analysing with the study data, all personal identifiers will be removed. Importantly, whilst the information received is specific to each trial participant, no individual person will be identifiable in any publication arising from this work. Your personal data will not be shared with any 3rd parties outside of the CCP-UK trial team and will not be used for any automated decision making or profiling. If you would like to have this data withdrawn, please contact the study team using the details given below.

Consent is not needed to obtain and use this extra data as described above, because we received approval from the Public Benefit and Privacy Panel (PBPP) for Health and Social Care on 17th April 2020 to link participant identifiers to routine data held by NHS Scotland, Public Health Scotland, GPs and National Records of Scotland. The PBPP approval is in place until 31st May 2021, after which the study team will apply to extend the approval if data processing is ongoing.

What to do next?

If you decide you do not want your data to be linked in this way you can withdraw from this follow-up, without affecting your current medical care, by contacting the study team, who would require your identifiers to ensure that your data is not included in the cohort. We will not request data from NHS Digital for anyone who directly requests not to be included. If we have already received your data by the time you indicate that you do not want your study data linked to routine records then we will remove your identifiers from our dataset.

Data protection regulation provides you with control over your personal data and how it is used. When your information is being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available at https://compliance.admin.ox.ac.uk/individual-rights or by contacting the study team using the details below. The University’s data protection officer can be reached at data.protection@admin.ox.ac.uk.

If you have further questions or are not happy with the way your data has been handled, please contact the study team using the contact details below. Alternatively, you can contact the study sponsor on 01865 616480 or ctrg@admin.ox.ac.uk. You have the right to lodge a complaint with the Information Commissioner’s Office (0303 123 1113 or www.ico.org.uk.

Email: ccp@liverpool.ac.uk