The Data Controller (the organisation responsible for how your data is processed) is Newcastle upon Tyne Hospitals NHS Foundation Trust. The Data Processor (the organisation responsible for processing your data) is Newcastle University.

The Trust is registered with the Information Commissioner’s Office and it is committed to protecting the rights of individuals in line with Data Protection legislation. The Data Processing registration number is Z6173332 and details of the registration can be found on the Information Commissioner’s website at www.ico.org.uk

The Trust’s Data Protection Officer (DPO) is responsible for ensuring that NUTH complies with the data protection legislation  The DPO is the person to contact if you would like to know more about how we use your information, require information in any accessible format or language or if (for any reason) you do not wish to have your information used in any of the ways described. The details are:

• Data Protection Officer
• Newcastle upon Tyne Hospitals
• Regent Point
• Newcastle upon Tyne
• NE3 3HD
• Email: nuth.dpo@nhs.net

If you remain dissatisfied, then you have the right to refer the matter to the Information Commissioner’s Office (ICO). The ICO can be contacted at:

• Information Commissioner’s Office
• Wycliffe House
• Water Lane
• Wilmslow
• Cheshire
• SK9 5AF
• Telephone: 0303 123 1113
• Website: www.ico.org.uk

The Trust collects a range of information in order to carry out research activities. This may include personal data and may also collect special category (sensitive) personal data as defined under Data Protection legislation such as NHS number and information on treatment.

For each individual research project you will be provided with a Participant Information Leaflet, which explains in more detail the kind of information that will be collected, and how this will be done.

Undertaking research, publishing research are tasks that are in the public interest. Some types of research will require the collection of personal data including, where appropriate, special category personal data, in order that the aims of the research can be achieved.

The Trust will only collect the information that is necessary to undertake each specific research project. Where possible, data will be anonymised or pseudonymised to minimise the processing of personal data wherever possible.

The data collected for the purpose of the research project will not be used for automated decision making or profiling about you as an individual and will not affect your rights to care/treatment under the NHS or otherwise.

All research projects involving the collection of personal data are subject to an ethics review, to ensure that appropriate arrangements are made for the secure storage of your data

Your data will be accessed by your local MDT members of the research team located at the Data Processor site (Newcastle University). Your personal information used in research will be de-identified before sharing more widely or publishing the research outcomes. It may be necessary to share your personal information with your local MDT should you decide that you do not want your details collected for IMPACT I.

In order to protect your rights and freedoms when using your personal information for research and to process special category (sensitive) information, data management will be carried out in line with the Trust’s policies for data privacy and data governance.

Pseudonymised research data will be retained for 10 years following completion of the study.

Under Data Protection legislation you have the following rights:

• to request access to, and copies of, the personal data that we hold about you;
• to request that we cease processing your personal data;
• to request that we do not send you any marketing communications;
• to request us to correct the personal data we hold about you if it is incorrect;
• to request that we erase your personal data;
• to request that we restrict our data processing activities
• to receive from us the personal data you have provided to us, in a reasonable format specified by you, to another data controller;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights and freedoms.

It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances a right may be limited when the data is being used for research purposes.

It should also be noted that we can only implement your rights during the period upon which we hold personal identifiable information about you.

Once the information has been irreversibly de-identified or anonymised and becomes part of the research data set, it will not be possible to access your personal information.