Data Controller

NHS West Yorkshire Integrated Care Board

Purpose

Under the Health and Social Care Act an ICB has the power to conduct, commission or assist the conduct of research into

(a) Any matters relating to the causation, prevention, diagnosis or treatment of illness; and

(b) Any such matters connected with any service provider under the 2006 Act as the ICB considers appropriate.

And also has a duty, when exercising its functions, to promote research and the use of evidence obtained from research.

Lawful basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

GDPR Article 9(2)(j) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union 35 or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Guidance on how to work in a research setting has been issued by the Health Research Authority, the public body responsible for the conduct of research, which can be found at:https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-detailed-guidance/

Type of information used

Identifiable: Personal

Who we will share the information with (recipients)

The research team works with a wide range of research organisations, each specifying their own data sets. Sharing of research data will only occur in line with the provisions of the individual Health Research Authority and Research Ethics Committee decision about the project, usually this will contain all of the named stakeholders.

In addition, the research team may share anonymised data that would be accessible under an FOI, this data would also be shared with NHS England and the National Institute for Health Research Clinical Research Network. The results of research will be made available publicly via the website, events, newsletters and through social media.

Do we use any processors

The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.

Microsoft Azure, supported by IT staff, host our data.

How we collect (the source) and use the information

Relevant and appropriate research always aims to answer a new question and contribute to the current body of medical and scientific knowledge, this is the purpose of research. The ICB will therefore participate in national and local programmes to derive new knowledge that can have a positive impact upon the services of the NHS.

The service will therefore assist in the collection of data to support research activity. For personal identifiable data, full patient consent will be taken but the data will not be handled by the ICB R&D team, only by the external study team.

For pseudononymised data the ICB R&D team may assist in the collection but would not routinely hold or transfer any data unless the research has received full approval form the Health Research Authority (HRA) and Research Ethics Committee (REC) for it to do so. For anonymised and or aggregated data the service will assist in collection and may hold or transfer the data depending on the approval received from the HRA and the REC.

The service will work within the guidelines of the UK Policy

Framework for Health and Social Care Research (HRA and the UK Health Departments, published October 2017). This policy framework sets out principles of good practice in the management and conduct of health and social care research in the UK. These principles protect and promote the interests of patients, service users and the public in health and social care research, by describing ethical conduct and proportionate, assurance-based management of health and social care research, so as to support and facilitate high-quality research in the UK that has the confidence of patients, service users and the public.

How long we will keep the information

5 years

Your Rights

With regards to Assuring Transformation under the UK GDPR you have the following rights:

  • The right to be informed about the processing of your data (this notice)
  • The right of access to the data held about you
  • The right to have that information amended in the event that it is not accurate
  • The right to restrict processing
  • The right to object to processing
  • Right not to be subjected to automated decision making and profiling
  • To be notified of data breaches

For more information about these rights, please visit the Information Commissioner's Office website.