Brain Health Study - Study Partner privacy notice

The types of data UK Biobank processes

What personal information does UK Biobank collect?

UK Biobank only collects personal information directly from you.

The data we collect falls into the following categories:

Basic Data:  this is the basic data which identifies you such as your   Please note that your Basic Data will not be shared or made available as part of the UK Biobank resource.

Opinion Data:  this is data which relates to your view / opinion of the symptoms and daily living of the participant for whom you are a Study Partner. This data is de-identified and stored in the UK Biobank resource alongside the data about the participant for whom you are a Study Partner. This data is then made available to bona fide researchers undertaking health related research that is in the public interest (as explained in more detail below). 

Pre-screening Data: this is the limited data (including health data) you provide to us to enable us to check that it is safe for you to enter the MRI scanning room to accompany a Participant should you be required to. Please note that your Pre-screening Data will not be shared or made available as part of the UK Biobank resource.

Who does UK Biobank share my data with?

Access to your data is strictly limited to:

• the Clinical Trials Service Unit (“CTSU”) - part of Nuffield Department of Population Health (“NDPH”) at the University of Oxford, who we have appointed as a data processor in order to store the UK Biobank resource data;
• DNAnexus Inc. – who are the provider of UK Biobank’s Research Analysis Platform (the “RAP”), have been appointed as a data processor (of de-identified data). The RAP is an online platform which enables researchers to use de-identified data in a secure environment to undertake their research. The RAP comprises a web interface provided by DNAnexus, and DNAnexus' approved cloud storage provider is Amazon Web Services (AWS) who host the de-identified data;
• our third party services providers and partners who provide data processing services to us, or who otherwise process information for purposes that are described in this Privacy Notice; and
• Approved researchers whose research project has been approved under our Access Procedures, which means that the researcher has to be a bona fide researcher and has to undertake health research that is in the public good. If you would like more information about the approved research projects which have access to UK Biobank data, please click the link below.

View Approved Research

UK Biobank’s lawful basis for processing your data

A legal requirement of the UK GDPR is that we tell you about the legal basis on which UK Biobank will process your personal data.

As UK Biobank is a research project, consent was sought from you to participate as a Study Partner in UK Biobank. Through the information materials and consent form UK Biobank set out to explain the basis of such participation and a summary of the scope to which your data may be used by UK Biobank and the research community.

Although you needed to provide your “consent” in order to participate in the UK Biobank research project, and UK Biobank would not act in a way which was in any manner inconsistent with that consent, “consent” for data protection purposes is a distinct concept.

UK Biobank uses the following lawful bases to process your personal data under the UK GDPR as follows:

• Basic Data (such as your name and address) and your Opinion Data are processed for UK Biobank's legitimate interests to improve health care (as detailed below) under Article 6(f) of the UK GDPR.
• Your Pre-screening Data (which includes health data) is processed on the basis that it is necessary for compliance with a legal obligation to which UK Biobank is subject, including the UK Health and Safety at Work etc Act 1974 (under Article 6(c) of the UK GDPR) and the processing is necessary for the purposes of management of health care systems or services (under Article 9(h) of the UK GDPR).

Legitimate interest

Legitimate interests are defined in the UK GDPR as “processing which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

UK Biobank is the “data controller” and in the UK GDPR (as there was in the GDPR), there is a 3-step test to demonstrate “legitimate interests”. This is set out as a series of questions and answers:

Legitimate interest purpose test: what are UK Biobank’s legitimate interests? 

• What is UK Biobank trying to achieve? Our objective is to set up and manage a major international research resource for health-related research that is in the public interest.
• Who benefits from UK Biobank’s processing? Patients and the wider public benefit from the advances made in the prevention, diagnosis and treatment of disease.
• How significant/important are these benefits? UK Biobank is now one of the largest and most used health research resources in the world.

Legitimate interest necessity test: is the processing necessary for the legitimate interests? 

• Is processing personal data a reasonable way to achieve the objective? Without the personal data provided voluntarily by participants and Study Partners, UK Biobank would not exist.
• Is there another less obtrusive way to meet our purposes? Your data are stored in a way that makes it is extremely difficult even for UK Biobank to re-identify you. Only a very few individuals within UK Biobank are allowed to do so (and they are strictly monitored). Data provided to researchers have personal identifiers removed so that neither an individual participant nor a Study Partner can be identified. Taking part in UK Biobank should not have any adverse effect on you.

Legitimate interest balancing test: UK Biobank has to weigh up the participant’s interests.

• Would Study Partners expect UK Biobank to use their data this way? Yes; this is what we set out in the information materials provided to Study Partners and in the study consent form each of them signed.
• How likely would a Study Partner be to object? In our view, this is unlikely. Study Partners are free to withdraw from UK Biobank at any time for no reason.

Your Data Protection Rights

Pursuant to the GDPR individuals have a number of rights:

• Rights of access, correction, restriction and to object for Basic Data and Opinion Data: you have limited rights in this regard. As set out above, UK Biobank processes Basic Data and Opinion Data for the purpose of enabling scientific (health) related research that is in the public good. In accordance with schedule 2, Part 6, para 27 of the Data Protection Act 2018 this means that UK Biobank is exempt from certain provisions of the UK GDPR, including the requirement to respond to data subject access requests (“DSARs”), require corrections, restrictions or facilitate objections.
• Rights to be forgotten, erasure and withdrawal for Basic Data and Opinion Data: these rights are covered by your ability to withdraw from UK Biobank at any time for any reason (although we should add that we very much hope that you choose not to exercise that right so that your data can continue to be used to help researchers study the causes, prevention and treatment of diseases).
• Rights of access, correction and restriction for Pre-screening Data: as the Pre-screening data does not form part of the UK Biobank resource, where applicable under the UK GDPR you may request access, correction or restriction of your Pre-screening Data.  Please note you do not have a right to erasure (also known as the "right to be forgotten") for Pre-screening data under the UK GDPR.
• Opt-out of communications: you have the right to opt-out of communication materials that are dispatched on a periodic basis. This right can be exercised, at any time, by clicking on the “unsubscribe” or “opt-out” link in the e-mails we send you, or contacting the PRC on 0800 0276 276, or by email ukbiobank@ukbiobank.ac.uk.

You have the right to contact, at any time, the UK’s data protection authority – the Information Commissioner’s Office (“ICO”) - if they have any concerns about UK Biobank’s use of personal data and/or UK Biobank’s approach to data protection and the UK GDPR.

Protecting your data

UK Biobank and its appointed data processors store your data securely and to the highest industry and professional standards. It undertakes regular testing of its IT systems to ensure that they are robust. UK Biobank also commissions external experts to test the security of its systems.

Before UK Biobank provides data to researchers, we first remove all the personal identifiers so that individual participants and Study Partners cannot easily be identified. In addition, your data are only provided to researchers on the execution of a legal agreement prohibiting the researcher from trying to identify a participant.

Only a limited number of people working for UK Biobank or its appointed processors have access to participants’ data with the personal identifiers (which is necessary in order to allow us to interact with you). These individuals are subject to strict confidentiality provisions and are required to undertake regular data security training.

UK Biobank will store your data for as long as it has a legitimate interest in doing so. The UK Biobank project is a long-term study and participants’ and Study Partners data will be kept for the duration of the project. However, should a participant or a Study Partner wish to leave UK Biobank they can do so at any time (please see below).

International Data Transfers

UK Biobank's main computer storage and that of its main processor, the Clinical Trials Service Unit (CTSU) at the University of Oxford are located in the UK.

Approved researchers and UK Biobank's other third party service providers operate around the world. This means that your data may be processed in these countries.

Where we transfer your personal data to approved researchers located in countries or organisations outside of the UK, which have been formally recognised as providing an adequate level of protection for personal data, we rely on the relevant “adequacy regulations" (data bridges) from the Secretary of State in the UK, as detailed and also summarised by the ICO .

See a list of countries where we transfer your data in reliance on adequacy regulations.

Where the transfer is not subject to an adequacy regulation, we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice and applicable laws.

The safeguards we use to transfer personal data to our approved researchers, are the UK Addendum to the European Commission’s Standard Contractual Clauses issued by the UK Information Commissioner under s.119A(1) of the Data Protection Act 2018 (the "UK Addendum"), using Module 1, controller to controller transfers. A copy of the UK Addendum in place with our approved researchers can be found in our Material Transfer Agreement.

See a list of countries where we transfer your data in reliance on the UK Addendum.

Data Protection Officer

We have a Data Protection Officer (“DPO”) who can be contacted with any questions or concerns relating to UK Biobank’s approach to data protection and the UK GDPR. Please write to the DPO using dpo@ukbiobank.ac.uk or via post: The Data Protection Officer, UK Biobank, Units 1-2 Spectrum Way, Adswood, Stockport, SK3 0SA.

Withdrawal from UK Biobank

You are free to withdraw at any time from the study as a Study Partner without giving us a reason. You are welcome to discuss concerns with us at any time, and the various options you have for withdrawal.  Please note that if you are also a UK Biobank participant and you wish to withdraw from UK Biobank in your capacity as a participant then you need to let us know.  Please see the Basis of Your Participation for more information.

Study Partners can withdraw at one of two levels:

• No further contact
  This means that UK Biobank would no longer contact you but would have permission to retain and use information you provided previously.  This level of withdrawal leaves the resource intact and will allow researchers to study disease with the goal of improving the health of future generations. If you wish ‘No further contact’, please speak to the UK Biobank Participant Resource Centre on 0800 0 276 276 (freephone number).
• No further use
  In addition to no longer contacting the Study Partner, any information collected previously would no longer be available to researchers. UK Biobank would only hold information for archival audit purposes. Such a withdrawal would prevent your Opinion Data from contributing to further research, but it would not be possible to remove data from research that had already taken place. You need to contact UK Biobank by phoning the Participant Resource Centre on 0800 0276 276, email us at ukbiobank@ukbiobank.ac.uk, or you can send us a letter at the address on this page.

If the participant for whom you are a Study Partner withdraws from UK Biobank, the data you have provided to UK Biobank in your capacity as a Study Partner will also be withdrawn at the same level as the participant’s withdrawal. 

UK Biobank contact details

If you want to contact UK Biobank you can do so as follows:

The UK Biobank free phone Participant Resource Centre is open on 0800 0 276 276, Monday – Friday, 9am–5pm. Calls from mobile phones or from overseas may be charged.

You can write to UK Biobank at:

1-2 Spectrum Way
Adswood
Stockport
SK3 0SA

You can also contact the UK Biobank DPO at any time using the contact details set out in the DPO box above.