Cancer Research UK Clinical Trials Unit Data Protection Policy

CRCTU is one of two clinical trials units based within the University. Clinical trials units (CTUs) are specialised research units which design, centrally coordinate and analyse clinical trials and other studies which involve participants (usually patients or occasionally healthy people) who volunteer to take part in the research. The participants are recruited from hospitals in the UK and in some cases internationally. The clinical trials or other research studies (referred to as trials in this privacy notice) are designed to answer questions about improving healthcare.

The CRCTU specialises in delivering cancer trials in adults and children but also runs trials in some non-cancer healthcare conditions.

Our research is conducted in accordance with Good Clinical Practice and the applicable legislation for that type of trial. All of our research is also reviewed and approved by an independent Research Ethics Committee.

See the Health Research Authority website (https://www.hra.nhs.uk) for more information about the rules and regulations governing trials.

Our research is led by a senior medical doctor and is usually sponsored by the University of Birmingham, but the CTU may work with other sponsors, NHS and academic organisations, as well. The sponsor of the trial will be the Data Controller for the purposes of the General Data Protection Act (GDPR), 2018, so this will usually be the University. If another organisation is the Data Controller for a particular trial, you will be advised when you are invited to take part.

When you are/were invited to take part in a trial, you will be/have been provided with a document called a Patient Information Sheet which is an ethically approved document which provides information about the trial, the information collected and processed, where it is collected from, what your involvement will be and how your data will be handled. It will also explain if other organisations are involved in the trial and what their roles are.

Data protection law changed on 25th May 2018, so if you received your Patient Information Sheet before then, this Privacy Notice provides updated information for participants in our trials about how personal data is used.

Information relating to trial participants:

At the outset of the trial, in order to answer the trial question and to oversee the quality of the trial, we collect personal information and healthcare data about participants taking part. This data may include:

• Name, date of birth, NHS Number or some other identifiers;
• GP/Consultant/Hospital name and contact details;
• Medical information which is relevant to the trial and/or your medical records;
• Your contact details, if you are a potential participant, who has asked to be kept informed about the trial, electronically. These details will be deleted when they are no longer needed.

During the trial, we will process further information about you, which will include:

• Details about your participation in the trial;
• Results/outcomes of any procedures, tests, interviews or questionnaire undertaken as part of the trial.

We will normally collect this data from you directly, or from the hospital where you are being seen, Very occasionally, we collect personal information and healthcare data from other sources such as GP practices or national cancer registries. For some trials data may also be collected from third parties, for example those analysing tissue samples or reviewing scans. More details about this will be provided in the Patient Information Sheet for the trial.

The type and amount of information collected for each participant depends upon the trial question, what information we need to identify you when we are communicating with third parties (e.g. the recruiting hospital) and whether we are contacting you directly. To safeguard your rights, we collect the minimum personally-identifiable information possible.

Some of the data we process is classed as ‘special category’ or sensitive personal data. This data includes data concerning health, genetic data and biometric data for the purpose of uniquely identifying a natural person, racial or ethnic origin, religious or philosophical beliefs or data concerning a natural person’s sex life or sexual orientation.

Information relating to healthcare professionals involved in the trial:

CTUs also collect personal information about:

• doctors, nurses and other staff involved in the recruitment, diagnosis, and treatment of participants taking part in our trials;
• laboratory staff, company employees, and staff from other organisation which are supporting the trial;
• members of the public who contribute to the design and conduct of our trials or sit on local working groups or committees; and
• healthcare professionals who contribute to the trial management groups and oversight committees.

We consider the processing of your information to be necessary for the purpose of:

• carrying out research, which is a task performed by the University in the public interest;
• scientific or historical research purposes, statistical purposes or archiving purposes in the public interest;
• for compliance with a legal obligation to which the University is subject, for example, retention of records in accordance with good (clinical) practice, inspection or audit
• very occasionally, for example in the case of an emergency, to protect your vital interests when you are physically or legally incapable of giving consent.

A single clinical trial involves many organisations including but not limited to: the hospitals recruiting participants, GP practices, laboratories analysing or reviewing samples, the sponsor, oversight committees and trial management group, national registries, pharmaceutical and biotech companies. It may be necessary to share participant personal (e.g. date of birth) and healthcare information with these parties during the course of the trial in routine communication or when assessing the quality and safety of the trial. The ethically approved trial specific Patient Information Sheet will provide information to participants on the organisations involved in delivering the trial in which they are taking part.

Participants are also advised in the Patient Information Sheet that by taking part in one of our trials that they are agreeing to allow research staff at their hospital and from the CTU to look at their research and medical records; and that it may also be necessary to allow authorised personnel from the sponsor, NHS, regulatory bodies, and occasionally the company to have access to these records. This is to ensure that the trial is being conducted to the highest possible standards.

Participant information may on occasion be shared with researchers running other ethically approved research studies (future research). These researchers may be in the University of Birmingham, the sponsor organisation (if different), or in other universities, NHS organisations or companies involved in healthcare research in this country or abroad. Information is shared in accordance with the CRCTU’s data sharing policy and access to information is strictly controlled. Where possible the information is anonymised before being shared. Participants will not be identified in any way in any report, presentation or publication arising from this future research.

Information on the organisations given access to the personal information of other individuals on whom we hold data and who are involved in the delivery of a clinical trial will be provided in the protocol, where the governance arrangements for the trial are described, and/or on trial specific registration forms.

Occasionally, trials may be inspected or audited by a third party organisation to make sure that the trial has been conducted in accordance with the relevant requirements. This might include, for example, the Medicine and Healthcare products Regulatory Authority (MHRA), NHS Digital or the Information Commissioner’s Office. In these circumstances, data is only shared as is necessary to comply with our legal and regulatory requirements and only for the purposes of the audit.

Within the University, trial data is shared with only those University staff who need access for the purpose of delivering our academic and non-academic services and facilities.

Participant personal data is shared as is necessary, on a considered and confidential basis, with several external organisations which assist the University with processing your information. These organisations act on our behalf in accordance with our instructions and do not process your data for any purpose over and above what we have asked them to do. We make sure we have appropriate contracts in place with them. Sometimes your personal data is processed by these organisations outside the European Economic Area (for example, because they use a cloud-based system with servers based outside the EEA), and if so, we make sure that appropriate safeguards are in place to ensure the confidentiality and security of your personal data.

Outside of the data sharing requirements described above, we do not share personal data with any other third party without the express permission of the data subject or as permitted by data protection law.

Participants are not identified in any report, presentation or publication arising from the trial.

Information relating to trial participants:

The information collected about participants is kept by the CTU and the hospital, or other institution providing the data, typically for between 10-30 years after the end of the trial, to allow the results of the trial to be verified if needed. This is a legal requirement for some types of trial.

Information relating to healthcare professionals:

Contact details of staff involved in trials are retained for the duration of the archiving period of the trial. This is in order to keep records of those individuals who have worked on the trial in accordance with Good Clinical Practice and for verification purposes.

Your rights in relation to your data:

Details about your rights are set out on the website page ‘Data Protection – How the University Uses Your Data’. However, as our research is being conducted as a ‘task in the public interest’ under data protection law, rights to change or remove information are limited, as we need to manage information in specific ways in order for the research to be reliable, accurate and verifiable. If you therefore choose to withdraw from the trial, we keep the information already obtained.

Our webpage ‘Data Protection – How the University Uses Your Data’ also explains how to ask any questions you may have about how your personal data is used, exercise any of your rights or complain about the way your data is being handled and provides the contact details for the University’s Information Compliance Manager, who will handle any data protection queries or requests.

For general information about clinical trials, contact: CRCTU-GeneralEnquires@trials.bham.ac.uk

This privacy notice is effective from 14 May 2018. It is reviewed when necessary and at least annually. Any changes will be published on this webpage.