Privacy Notice
United Kingdom Childhood Cancer Study on the Health of Childhood Cancer Survivors
This information is provided under the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This shows you how personal data is processed by the United Kingdom Childhood Cancer Study (UKCCS) in order to research the health of childhood cancer survivors.
The University of York is the “Data Controller” for the information collected in UKCCS. This means that we decide how to use the information and are responsible for looking after it in accordance with UK GDPR.
Our contact details
If you would like to contact us, you can e-mail us at: enquiries@ukccs.org; or write to us at: The UKCCS, Epidemiology and Cancer Statistics Group, Department of Health Sciences, University of York, York YO10 5DD. Alternatively, you can call us on our freephone number: 0800 328 0655.
This privacy notice was completed on 14 March 2022. The notice is tailored to the UKCCS and should be read in conjunction with the more general University of York Privacy Notice.
The type of personal information we collect
We collect and process the following personal or special category information:
- Date of birth
- Sex
- Ethnicity
- Cancer type and diagnosis date
- Genetic data from diagnostic sample(s) for individuals who had cancer as a child
- Secondary healthcare records
How we get the personal information and why we have it
Initial Collection
Most of the personal information we process was collected in the early 1990s when the UKCCS was established. At that time, the study collected personal information on children diagnosed with cancer before the age of 15 years in England, Scotland and Wales between 1991 and 1996; and a randomly selected group of children of the same sex and similar date of birth. This information came from NHS population registers. Also, if you were one of the children who had cancer, we asked your parents if they would allow us to store a sample of your blood for research purposes.
Ongoing Collection
The UKCCS links to national hospital healthcare records and other sensitive data, including national databases of cancers. This linkage enables the UKCCS to study the health of childhood cancer survivors, comparing them to similarly aged people who did not have cancer as a child. This would not be possible without linkage to healthcare records.
The linkage to healthcare records was established by sending personal information, including sex and date of birth, to the national authorities who routinely collect health data. The third parties who are involved in linking UKCCS information to health data are NHS Digital (England), Public Health Scotland, NHS Central Register Scotland, Digital Health and Care Wales, and the Secured Anonymised Information Linkage (SAIL) Databank. The health data we receive from these national authorities is only processed at the University of York by named staff working on UKCCS. It is never shared with any other parties.
The UKCCS was not designed to keep in touch with children in the study, and we no longer hold names, addresses or other personal information which would allow us to identify individuals. Under the General Data Protection Regulation (GDPR), the lawful basis we rely on for processing personal information is:
Article 6 (1) (e) We need it to perform a public task;
and for processing special category data, such as health data, is:
Article 9 (2) (j) Processing is necessary for archiving purposes in the public interest, or scientific or historical purposes or statistical purposes.
This legal permission is granted through Section 251 of the NHS Act 2006 (Reference: 18/CAG/0066) and is reviewed every year by the Health Research Authority’s (HRA) Confidentiality Advisory Group (CAG). A condition of this permission is that the UKCCS cannot, and will not, identify any individual in the study.
How we store your personal information
Your information is securely stored at the University of York in the UK.
UKCCS will store your personal information for as long as there is a legitimate interest in doing so. The UKCCS is a long-term study and your personal information will be kept for the duration of the study, after which we will securely destroy it. We cannot identify you within the UKCCS, but if you do not want your data to be used for research in this study, you may find the information below useful.
Your data protection rights
Under data protection law, individuals have rights of access, correction, restriction or to object to processing as well as the right to erasure, to be forgotten and to withdraw from processing of their information. UKCCS participants have limited rights in these regards however; this is because we are unable to identify individuals as the personal information we hold is not sufficient for us to do so.
You can opt out of having your health records being used for research; the NHS will only use your personal data for your own healthcare purposes. If you are certain you do not wish data from your health records to be used by research studies including the UKCCS, you may find information about the national data opt-out helpful if you live in England, which can be found at www.nhs.uk/your-nhs-data-matters/.
How to complain
The University of York has a Data Protection Officer who can be contacted if you have any questions or concerns relating to UKCCS’s approach to data protection and the UK GDPR. Please write to the Data Protection Officer using dataprotection@york.ac.uk, or via post: The Data Protection Officer, Legal Services, University of York, Heslington, York YO10 5DD.
If you are unhappy with how we have used your data, you can also complain to the Information Commissioner’s Office (ICO). The ICO may be contacted by post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; via their helpline number: 0303 123 1113; or the ICO website: www.ico.org.uk.
Version 1. 14 March 2022